{ "Event": { "published": true, "date": "2026-01-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-01-31", "timestamp": 1769904181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3f8aa953-181b-4c19-9671-94be0b2c0595", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54685b35-fef2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769897720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769897720, "uuid": "4ddd7ce2-2ad2-4e3b-a3f0-7129c2fdbd06", "comment": "Malware payload", "value": "90bf26ea421a45914df452392badd19e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769897720, "uuid": "cd5db2c4-86e1-4b41-a131-3c954144d808", "comment": "Malware payload", "value": "00bfd63475dbf0fbe6473a52545ccd310a6927edee871ffb5236a901c4c71bbc", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769897720, "uuid": "ea5c0dc8-4640-4239-b6e4-236b866445d6", "comment": "Malware payload", "value": "e2c55596ba96ee7678285bb357b4c6dd6dc1135e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769897720, "uuid": "4556776b-fa4b-4a82-b43e-6225e2b1ca98", "comment": "Malware payload", "value": "5a8102fac47df6044c5f80846b368ed9064fba112ef259755210420a9ae80e307f6e69e0c9241df087a2a4a78bbd5ebb", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769897720, "uuid": "f9257560-e94f-44e7-8704-29b1a5c2d945", "value": "T1E8B533921AE105FEF433D27292E3DE46F25F7B824D546B53636BB9840F963870E32609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769897720, "uuid": "b26f1a72-1134-42a2-bea1-2d2a8bee3ed8", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769897720, "uuid": "2d0c2bdb-e7ee-4021-84ae-b518847bc516", "value": "49152:pYzeg8w73UUUqu370Bwfzxym7xGKoNcm3izbPRenL4cEto27VL0hDN:puEhquLfzxhJoNcm3iHkL4cWl0hDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769897720, "uuid": "06be2486-b6f6-42b1-b0db-a819fde0a1db", "value": 2353888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769897720, "uuid": "dffdec3c-53ea-4f3f-97b1-2c66913977d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769897720, "uuid": "f8f571e0-ce26-4b6c-adeb-36497fa139e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc7bce2-fed9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769887211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769887211, "uuid": "8cbd6e4e-d9ef-4c85-a8ad-310aec82c49a", "comment": "Malware payload", "value": "54c6e78d44fe6f5327852496bd31c6a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769887211, "uuid": "32d74dbc-0ce8-4ece-942e-c1b4436ca0d1", "comment": "Malware payload", "value": "01b28477d034ad53c65c600e1cbe705efbaf34d512636afef3f20f288e003075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769887211, "uuid": "1bd4f0c0-7051-4b63-abac-b1f7a0ea94f2", "comment": "Malware payload", "value": "5b32678710ce3c575591a8f8c96df0663070288a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769887211, "uuid": "e903501b-df07-45c7-a4c5-4fadb09e0a43", "comment": "Malware payload", "value": "fba34818a6d92a1d70d90f0a7e0dc79e245293bc18294036bd132d4228d1e8ac0f96a5392f0e0342435b6d11758e825f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769887211, "uuid": "ab67f423-dba8-4abc-abb0-6cff26fec344", "value": "T1EA463A52B89619B5CABFE23090601391B631759403313BD7AFD919AA0D7EFC8273FB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769887211, "uuid": "3f4e6b42-1088-4b56-a1da-061e66138ae7", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769887211, "uuid": "72b222d6-c6cf-45ca-b3ec-d9b794a17988", "value": "49152:gXUEALj3KKLHpUUysMRWBAgDTzQRGBhsyS/cv+eZ1VKLw4DWl3aAF0+K1OR:73KK3xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769887211, "uuid": "31e32ff1-9e43-4092-b5f6-26a93ae151c7", "value": 5535360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769887211, "uuid": "d47a62e6-bea2-4c38-8097-23fb118e25f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769887211, "uuid": "e04e9fad-bf46-4dfb-ad37-d862a11ca39d", "value": "SecuriteInfo.com.Win64.Malware-gen.32339233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ec7ae4-fe9c-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769861054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861054, "uuid": "5345b62f-787a-4188-b595-e360ee203ea1", "comment": "Malware payload (AsyncRAT)", "value": "348bd812c6ddb53774cc41259d39dbcd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861054, "uuid": "34b1eee7-a7f4-4b28-88ee-e2f5035aa9bb", "comment": "Malware payload (AsyncRAT)", "value": "02b93705ddbc4c6c5b293cd48623ef3289bcc5815706a6d693665176918dfe1b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861054, "uuid": "10ec7733-c5e3-4074-b1a0-74eb0e2844cf", "comment": "Malware payload (AsyncRAT)", "value": "8cb2a9b5ee5ee3e09e4e9058bb1de1b1a2dbc5b7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861054, "uuid": "e4552ecd-de66-4724-bcff-5ae9504199ab", "comment": "Malware payload (AsyncRAT)", "value": "e2ee8f7b3215a008e233dff2054f7f6c7bb22790ffd340962b9f696007b7d36427e8d100100a18843d18bd04ae097d7c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861054, "uuid": "40f9cbc7-9a5c-4cb2-b123-d992cdb5cf50", "value": "T159A4C2F12396C15CE0BB0B776D6241FC027ABD362036D6097C84769F5A7AFC574234A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861054, "uuid": "b0785a66-0351-4446-a9d0-b275c957b738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861054, "uuid": "ba5b1e26-be10-46a8-8ba0-a60b0c85e6d6", "value": "1536:7ETnVGdbUHKHyqcGbbsw1rfYOGEVQP2Y962Jr3tzDXAaVclN:7aVCbtybGbbsSPPQbJr3tnwoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861054, "uuid": "5d73bb38-be4d-410d-84c2-c5c64cc02378", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861054, "uuid": "4673033e-c49d-4938-bda0-d197de55b598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861054, "uuid": "0cb8d215-f10f-4916-8c43-1215ffb3d034", "value": "161bet.com.br.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a97d1f-feff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769903518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903518, "uuid": "2fc74339-baad-44ef-b87c-0c8dfb03832d", "comment": "Malware payload (Mirai)", "value": "9dbcb4a8886ca0efec00655e34db2e68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903518, "uuid": "4029f225-1832-4c2a-a9e4-b0ad8f99e7ab", "comment": "Malware payload (Mirai)", "value": "03c8563c4faee3dc3e77db39f7d151b6810f65f5cf0d00af73d1d895a86b35a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903518, "uuid": "b77e07d7-0f11-42d1-838c-310a1200e05b", "comment": "Malware payload (Mirai)", "value": "d4bc5ed2011701c8cb7981019af5e8b399aef4b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903518, "uuid": "8474c3f2-8703-4186-a1ee-83a2e8752053", "comment": "Malware payload (Mirai)", "value": "76333c238a20204ec3ad383cf53cec065e9a6c61b7cda12615a4cff1d0eefef5f3cf1a80c0a3124490ce82a9c95297a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903518, "uuid": "b1e90824-af31-4991-a6a9-ed392624703f", "value": "T179F35A87EFC90ECBC45BCEF0467F43AB19E355AB4CD2A2F4487C8C18794919A85E3658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903518, "uuid": "0fb3c051-f4d1-4fc2-aad8-30512d9814e0", "value": "3072:3g7KKSFHXkcEqHqaxrrJuRuRl+jxLY+fpEStfbsi5IEisiq:WKKQEqHqsrg4l+jxLPfpXAi5IEZiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769903518, "uuid": "3d919955-527b-4282-86bb-76c6b2c6c5ca", "value": 172064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769903518, "uuid": "09faade3-3888-4e11-b1a7-db0cbb7f7bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903518, "uuid": "37be15e4-14aa-4aa8-92cf-70152f99af16", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a834425c-fecd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769881969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881969, "uuid": "f14cc810-7124-4614-bb30-0cbb947861b2", "comment": "Malware payload (Mirai)", "value": "79bfaa9ffe0359dfc889fce9d67bc83f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881969, "uuid": "8aadcf31-8953-491a-92fe-d4266476927b", "comment": "Malware payload (Mirai)", "value": "03ee4f23ba937284e9687e87ca0dd91696e91e5af1ed39583b47017ed30aba61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881969, "uuid": "ebcb0372-e717-4a8b-8696-821b48774149", "comment": "Malware payload (Mirai)", "value": "98e69f669c665daa8ab2f2e91f0fa78fd6a1104c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881969, "uuid": "3ab7d754-7b2b-4787-a783-56e003f4c0c6", "comment": "Malware payload (Mirai)", "value": "db81f17fa1e8b0a4d811138dab663147fa5a81a59af604385ef169633993d9292a5c87b282d0fc9e1eaf45a8e7e38b7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881969, "uuid": "569edb16-1653-4cd0-bf75-919ba498927a", "value": "T105D44A59A8419B95D1C02BBBFF1DA34873132B38E3EFB1069D195B246B9BC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881969, "uuid": "6bafea21-9238-4ad0-bda9-29695a3c5262", "value": "12288:SqttngiaW/ukdFE4rp9HCkcJpEpKWRfWRugC+8uI6bJab9a+d5Jq0Xuk0YZ8NR2:Sg5dFEw9HCw/WRJIDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769881969, "uuid": "1d3e31a8-f986-460a-af6b-ade284f0be41", "value": 602184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769881969, "uuid": "7708dd70-36f7-409d-aaef-f03cd7cb1166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881969, "uuid": "22adaad6-100a-490d-bbfb-9ceb4b22265f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a28db2e-feee-11f0-a129-42010a9c0007", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1769895904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769895904, "uuid": "a2b39df2-45df-4608-b84c-4e5e8c258544", "comment": "Malware payload (Spambot.Kelihos)", "value": "5dc395bdeed0ac727586defc61a6b8d2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769895904, "uuid": "e2ca622f-efb3-4d61-a40b-8ae6914039a5", "comment": "Malware payload (Spambot.Kelihos)", "value": "043411ec48a610695668589c877e96b333b1a7b2ba07304ab0776339edf61cc1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769895904, "uuid": "8a0aa075-bab1-4f1f-a2e6-27774b8d31de", "comment": "Malware payload (Spambot.Kelihos)", "value": "51dc56f5c78ccac565abf297ebbec24e27b97c3e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769895904, "uuid": "6749f829-d1c2-48ac-a845-95f7c82a29ca", "comment": "Malware payload (Spambot.Kelihos)", "value": "b5015c4e8ad76bd62e57e47445d2513f5c9b5ac8b2acb2981a36897365ea126dd5252fe06f5d367ea45e852f5f421281", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769895904, "uuid": "f09afff9-6fea-430a-aca7-b35165785371", "value": "T187B4020BE5E89031DC55877055E702C31637FA902B589793678FED5A28B32B1B37522B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769895904, "uuid": "444ac707-56b5-4254-b65d-6c86ca7ba344", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769895904, "uuid": "a981c73a-7280-423f-bf1e-15f91a947fba", "value": "6144:K9y+bnr+xp0yN90QE6IqHq7Lfdt3LmrXiQQRcrbtfc6sN+8UAsqFOqmu3Fe1uPx6:DMrFy900K7rbhDc+6uhb8+DJXiQVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769895904, "uuid": "12085b51-46ed-4f7f-8eef-353ae0b1179e", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769895904, "uuid": "fb7187f7-f9d4-4559-b5d2-6c90bb33f937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769895904, "uuid": "0a094617-d47e-4fe4-bb5b-bf6b750c5b66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc19b5b6-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884633, "uuid": "6a9e3e5b-58f3-4769-af69-a29715545581", "comment": "Malware payload (Mirai)", "value": "a366d2813567338a9648ebb19e2a2674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884633, "uuid": "2d2732a0-1a4d-4a2a-88a8-e319cac02088", "comment": "Malware payload (Mirai)", "value": "04550a80648463b01a4d04ae1919f0dae3b350eefc661b6ca7ec646259a2f393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884633, "uuid": "73e06a47-d6f1-4156-ad75-9329e0e5f50d", "comment": "Malware payload (Mirai)", "value": "a9f5bd3620644379b69189464ab0dcfd152c9442", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884633, "uuid": "20a86a8b-97ad-4680-9e8e-db4387d10163", "comment": "Malware payload (Mirai)", "value": "268bf532d7ded3e2b89a1a77bcc48828d6baef669eec05dd99549201f69653e1cdbb43cec9613feb00fabb0477319023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884633, "uuid": "534b6eb2-63be-4886-9c0c-518789517114", "value": "T15783D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884633, "uuid": "3a6a8a61-635b-44f5-94ee-65c16e81d3e5", "value": "1536:iVLyu95KRZkj752dCexuV/8UZlDwfkJ4MYfWa:iVLyMg+Fezxu5VD1eX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884633, "uuid": "9d2c2ca6-4093-4a84-a42c-c7405e10a41d", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884633, "uuid": "6d46b4bd-74f8-4cdd-b4b2-3f2169ff2953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884633, "uuid": "e94193d1-e9a6-4646-99c3-e2a5b34f23ba", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e146e4-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877193, "uuid": "6a9d9f09-2a83-47ce-b4f8-4edccee0b9d6", "comment": "Malware payload (Mirai)", "value": "055915c8942c2bc3cdb33c191676057c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877193, "uuid": "29778b1c-50a3-4ef1-84b4-edd6d80f35dc", "comment": "Malware payload (Mirai)", "value": "05138b2ceb8f7e3a4f640dd4e7c1adf726b5f2f9d4c68e4b790cf758f225915f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877193, "uuid": "17136894-9b79-4698-8026-3ac03616a023", "comment": "Malware payload (Mirai)", "value": "951d992b86ae5d327838dfc34fe242e1ff39fa76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877193, "uuid": "1fda5b2f-740c-4310-b3cd-b1aadf74f0ee", "comment": "Malware payload (Mirai)", "value": "ba9409d938233f50be6223cc2d4664c6ec9899939c541957c6823402fdb739fe568aff6920aba67f1331b042a00f99b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877193, "uuid": "01a66141-37d9-4333-a78d-ea86b090d6c8", "value": "T112832BEFCE390393D8EB46F23C1733E88B2CA13192D422C596069AD107B7539653AF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877193, "uuid": "97201bd4-b498-4311-895d-4dd81a57737c", "value": "1536:z15+uvk2Bw+c9SRID+2hNpHmAx07Zfvs2tCjapnRcLtVa4y:z75IDdzHmLfvKjapnRjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877193, "uuid": "ae217e13-b78f-4493-a098-69054b13309e", "value": 88673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877193, "uuid": "5fe42adf-a5af-4d42-bec9-f33f3e4f1944", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877193, "uuid": "b0e820cd-0ae9-45a4-a78b-d81b9f9c15ea", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d1cd66-fe84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769850477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850477, "uuid": "a7491205-bda6-45df-b779-e306bb022f80", "comment": "Malware payload (Mirai)", "value": "5e138da5734b0789f506e9eb62f7a54a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850477, "uuid": "44f3d7c0-11c3-46c8-a63d-d4c052bdaf05", "comment": "Malware payload (Mirai)", "value": "0534fad625aefe275a28b397d3dfcccfd1173276f60cb4b70000a2909e339042", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850477, "uuid": "8fd110e6-8966-4628-a969-44689abc9db6", "comment": "Malware payload (Mirai)", "value": "a561216baa4851c0111e1d8491c3cffaed4aa84c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850477, "uuid": "b4b3ddda-c997-400e-8e26-6e447f915dcd", "comment": "Malware payload (Mirai)", "value": "0066ad23b3ac32ab83225e59d54c6dc6b2bb98545c0eee98a7a8c4a1e6ca76ad24c85183b3a3a62dc220bae1cfa95ca9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850477, "uuid": "3e40d1bb-79d2-4738-9143-f43eff443d59", "value": "T1B2F35A87EFC90ECBC45BCEF0467F43AB19E355AB4CD2A2F4487C8C18794919A85E3658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850477, "uuid": "26cbea45-7269-471f-b1dc-a533c217d1e2", "value": "3072:3g7KKSFHXkcEqHqaxrrJuRuRl+jxLY+fpEStfbsi5IEisiq:WKKQEqHqsrg4l+jxLPfpXAi5IEZiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850477, "uuid": "a30ed690-b437-494a-8444-a1ca02b8487c", "value": 172064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850477, "uuid": "fa9cc90d-21c2-4cb8-9eca-8567d4353a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850477, "uuid": "71baba36-d9b3-4985-ad62-39b8b382888a", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28471d07-fe39-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769818189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818189, "uuid": "49a925b9-34c9-4e33-866e-d1afe26fd54a", "comment": "Malware payload (Mirai)", "value": "a0b83c6afc160b2457ea185c090d7133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818189, "uuid": "2b7006d5-d039-4e08-bb54-2c14ab38acf2", "comment": "Malware payload (Mirai)", "value": "06dd3b36f9fe5ffa7458e6a1d0e15aedeb04bfca79293beec3510d8353658041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818189, "uuid": "f345ab2d-5ef3-486c-a410-2387b10d3258", "comment": "Malware payload (Mirai)", "value": "cb4fd1ff128fffc89b96833d789cdd172cc701b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818189, "uuid": "4ac2b8b9-2800-4a92-bf54-3e6434892d07", "comment": "Malware payload (Mirai)", "value": "f5b82d6c2bf0b9b308604dbce448c6b7d01c571b1b694a5d65f37df904df103043294a32c662ca768bff33f45f409f70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818189, "uuid": "9de8ecf8-f14c-4cf8-9382-91e07d13f28b", "value": "T173A3C64B6E52DF7CF32C83344BB39B3A665923D633A0C585E29CD9411E6024E586FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818189, "uuid": "7c11aaeb-ca5e-4ea7-a7dd-1f3b3cff32f2", "value": "1536:bsBmTp359CaFCaSEaXdFdypep8A7yPZlmZGLbXCszKjQuLH0XnSaf:bs6p36PVQmZwXBWXH0XnSaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769818189, "uuid": "8d82130f-a7a5-49e2-b521-d54c4d5dccd6", "value": 105252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769818189, "uuid": "2e7420d6-9b5f-4d97-b369-2ca7fe3b44b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818189, "uuid": "dee66637-1a95-49e6-823b-f27ea1b6a3c8", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc923de-fe3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769820879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820879, "uuid": "7ac291a5-0626-4e33-9370-160346920e30", "comment": "Malware payload (Mirai)", "value": "5628c66764533cf5b4cd43d5d1744dd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820879, "uuid": "57c49687-e936-4673-8ba3-5364e4369fe8", "comment": "Malware payload (Mirai)", "value": "083d2a6ef82f01b436f150b3a8ea989767f456c3ac380cf3373b58f960000e60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820879, "uuid": "2c389694-1f73-47c2-b20e-949d2bcc2d2f", "comment": "Malware payload (Mirai)", "value": "56e196c3ff329a55401e63add9ff177683104e8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820879, "uuid": "ff3f7068-8720-4162-9402-fc6973da2078", "comment": "Malware payload (Mirai)", "value": "896075e42643cd5d38e2679c7c8115b5af1a39497251c307c2bd5f2f791a9b0c9511922ed1c1d1668762b37ceddf4b0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820879, "uuid": "655c4039-1785-41f4-95ac-241c0a02fb9e", "value": "T101034CC8B903DEF8FC1606F42136F77A9BB6F07E2128DD97C39995329C42A05A5062DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820879, "uuid": "47b48d00-0fbd-4942-a91b-47094d51b429", "value": "768:wZT8epBPi4gJW0KMcjp49A9/YuEGWlqEPEgouBnk6PyJiE9Ee4V:wZIezPi4gJW0KMgp49Ax8lvPFxBnk6P4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769820879, "uuid": "66bec0d7-6120-4c0a-89f6-b64b493ad205", "value": 39356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769820879, "uuid": "f8ee46e0-8db7-448b-9d74-731f49e23893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820879, "uuid": "91c11db4-7783-4ce8-a2b4-55ce967fdc4e", "value": "0upx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ede9461-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877202, "uuid": "07b3ce3f-c2aa-4246-95e0-388044cb1123", "comment": "Malware payload (Mirai)", "value": "ee20499d8c5e7b2580e61dc2aafb2a4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877202, "uuid": "376cb6e9-fb98-489f-bcfa-8008f439d344", "comment": "Malware payload (Mirai)", "value": "09610940f2b32ad725a8c323dd24f5fbe80cf5df11a6efb4f3ac077da0f0c904", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877202, "uuid": "196585d9-6e47-41f1-9a2c-fde8bc6b19e4", "comment": "Malware payload (Mirai)", "value": "e35aa31788cee6916b695ec9e720517d0aa446cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877202, "uuid": "ab60327a-252d-4ee3-a3f6-f87529e85cc8", "comment": "Malware payload (Mirai)", "value": "528d3fc41121b5fc8f1c2e64933170704b0fb79bdbb130403bfb2a46bd2a394e21f4a20f1d48e526f526045c5c70dc64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877202, "uuid": "eb3f8451-d37b-4187-a9eb-30d38a0cc1d4", "value": "T127A3A388F964A37EC7E1B7FBE75807CE333A0A98A7CB7721993406146BC97547935220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877202, "uuid": "e56e4653-9872-402a-9419-f02e2cbe2cd6", "value": "1536:oupuszoeo1CRfPaqt7KeB/zRUeU99zDccAYZ4gc+wV4PGW9W:oupuszSeU99zD1HxbPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877202, "uuid": "a8237b52-e706-4bdb-bf9a-db15e0058e6f", "value": 99817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877202, "uuid": "7f1187f8-513c-4ef6-bc68-0b5aa45724ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877202, "uuid": "44106140-3b76-4231-abce-9ebced4aa63d", "value": "bot.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150591d0-fe9e-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769861535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861535, "uuid": "f4bab643-dc50-452d-aded-8337ab8da8b6", "comment": "Malware payload (Vidar)", "value": "ff643f984bb67a9933bb43532dee0e63", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861535, "uuid": "4435de82-8ac4-427f-a44a-fcaba6a6c0cc", "comment": "Malware payload (Vidar)", "value": "098e0f982f6e766e1f9603075e7b91addf6cd5839ff3bbebae8ec280d2cb2421", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861535, "uuid": "3af6dff9-aad4-4596-bed5-6e815246e0f3", "comment": "Malware payload (Vidar)", "value": "50d36c3f221f197c2dfbd5c05192f3156b1c4bd9", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861535, "uuid": "d5e9eeff-57a0-481e-8fc0-344a00031458", "comment": "Malware payload (Vidar)", "value": "8c8226d3d3a39aa8c6fdfbc594f1555d69082ef798bab23da06fa36f807407b2c18170270ce1480afb7a638aa8699fbf", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861535, "uuid": "aaf91cdc-c8a8-42b4-94d8-026c749fff2e", "value": "T1F8463AAB32E885B9C11EC23FC4A28F40D4F7B0751737C2E702911768DA668D56E7EA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861535, "uuid": "f0664614-815a-4cb9-868f-5dd41f8e0aa7", "value": "07fba07802e4a95408526be16e22b7fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861535, "uuid": "9720539d-956d-4b41-a4da-b437f0ab5e0a", "value": "49152:wlfUFv3+WavCTC1DtFSPzsSxuB8StMAnJuMyeKvWsYxR8dm3:S5wYxadm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861535, "uuid": "611719ff-1874-4174-bd92-c37de0bd17f7", "value": 5373952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861535, "uuid": "63f8e696-0cd9-4ec8-8b2c-39b75710fe6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861535, "uuid": "db273a1b-09cb-4d08-98f2-7463230cb25f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a95ca2-fee9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894089, "uuid": "a30dee23-9129-4218-bbaf-cc5f02218698", "comment": "Malware payload (Mirai)", "value": "83fea6c6cd1813f535d910903a1c143e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894089, "uuid": "fe9bdbb1-0baa-4a45-9b51-b34ef382d218", "comment": "Malware payload (Mirai)", "value": "09f97e33480bb2301e5fdad95de9d84a1c151ca2bf7443e1f8f494452e8ad007", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894089, "uuid": "f8d8631a-6fc2-42ee-805f-60b547b5212f", "comment": "Malware payload (Mirai)", "value": "3f97f480a927183f08e8714be4b71464ebabfe15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894089, "uuid": "ef77a425-cf10-46f5-af0f-7261c4efcafa", "comment": "Malware payload (Mirai)", "value": "a3fc1457b424a1ba8f5c8a73c70ab77a4b3593c8813084411584c9ef052458eb9c3444f8c3ee9ec510ad4633c9101895", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894089, "uuid": "a779de65-dcfc-48d0-af3d-d1751921b4f7", "value": "T179815BE722224FBAC3040F56F550C943E282C9E4E6B3B158B9447D66B5D8F38BC4DB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894089, "uuid": "1b9db49b-6c70-4774-8326-37e693fcbda5", "value": "24:ID+BVPXrTeMQEriLDdX/4HcrT6gPrfvCcbcfq5TBrvRz8ubrD6Pt2oF3rC9HDrtS:HZQndrfRokddjk19kcwbyJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894089, "uuid": "d890c37e-9c35-421c-a19c-0d6d2dac051e", "value": 4169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894089, "uuid": "3d3399fd-e0d0-4add-88a2-916b8c463b39", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894089, "uuid": "c5a3f4d9-b626-4d92-b239-9099f4be9270", "value": "ssh_config_upd.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d314817-fec5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769878273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769878273, "uuid": "fa902d15-044b-4b15-ab3f-42cf6dd3b8ba", "comment": "Malware payload", "value": "71b9cab9e0b9b56ca85264d834e8e611", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769878273, "uuid": "8b298db2-8d0d-4725-90c2-5be2387ba1af", "comment": "Malware payload", "value": "0b4eea74eacbc6add1fe935e4b4268fb12c049ecb6f63aec9905d81df23a19a2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769878273, "uuid": "fcf00f65-2f18-4413-93e7-5a275cc54c43", "comment": "Malware payload", "value": "0ae7fc6d9cb20cdfcbb46677dd635654c15537a5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769878273, "uuid": "db71f286-5b42-4bcf-b734-bcb451c55e3b", "comment": "Malware payload", "value": "b2f8ad613913f4ba0eecae23be3d883f9c6604bef475f98e368fb09ec64c7904b99a71a1abda6b50dda8cfc7ba99b8e5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769878273, "uuid": "0033cfc7-dc0a-425d-928a-5d205132d281", "value": "T151847D56EBA440FCE07BD175C9724907D772F88A47B1AA8F03D459921F236B48E3E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769878273, "uuid": "e40351a1-2f49-4f30-9b86-c8552d498118", "value": "2c3611895c75f0901421dd578ded8a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769878273, "uuid": "67fb9d82-257a-4f86-8b32-a34636b9a838", "value": "6144:2qORK54/I3zQ/Dt8t/klq/YUrtEttANXeO6LJ8q4RhEFD4Cz1:ZORKrzQ/D6t/aMEtsuO6L6q4Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769878273, "uuid": "a0a26a82-01de-4745-b026-d7249d16fb4c", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769878273, "uuid": "914750c3-2619-4e1a-b25f-440463e0c38b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769878273, "uuid": "877a7a43-551a-420e-be1f-366a7782037e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5229e2b-feed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769895761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769895761, "uuid": "70523915-5a59-45f1-9e52-29ed60ba050d", "comment": "Malware payload", "value": "7ff516f8c4657e57c3744d69c4e1f001", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769895761, "uuid": "b3b0e8db-b1f4-453b-b388-54ef5c753b14", "comment": "Malware payload", "value": "0bdee817ef1281417b289f2d31b17c476bb11143f8ad0ab730909ecb340e881b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769895761, "uuid": "2bf166f3-048e-4211-b732-c2f3010dd090", "comment": "Malware payload", "value": "90c81157f2999f4c855ec19b8609879431d30a4d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769895761, "uuid": "8356bd46-6064-4afd-9630-223b49528190", "comment": "Malware payload", "value": "7bee3bb78feabf7eeb84d64d547b5f93455664f3eb9fa2e218fc548be17bda12cc9c075eec4711042063f96382903e32", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769895761, "uuid": "2b5dbc9c-80c1-4a59-9dd4-675ef21e2e8b", "value": "T1D4464AAB72E88179C11EC23FC0A68F40C4F7B1B50737C6E702911768DA668D56E7EA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769895761, "uuid": "12557b62-755e-46e0-a67e-34acd749cf35", "value": "07fba07802e4a95408526be16e22b7fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769895761, "uuid": "8232c642-bfab-48fb-b7a6-1ed8dc5d4f11", "value": "49152:ZlfUFv3+WavCTC1DtFSPzsSxuB8StMAnJuGyeDAPPPu+HQdcO:fvBaQdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769895761, "uuid": "b0fdf5cc-da2a-4c72-8b81-9d8916e66f74", "value": 5421568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769895761, "uuid": "06979002-237e-4ed9-9b0b-78107621e32d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769895761, "uuid": "b6155306-1369-41ee-a6ed-38d73b501343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e782c7bc-fed1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769883793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883793, "uuid": "36086d5b-671c-4561-881f-015c5903ef55", "comment": "Malware payload (Mirai)", "value": "001ccbde821b6599274e3011d4ebb448", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883793, "uuid": "35b69a88-3644-4d7e-9529-c3e29cc70b5e", "comment": "Malware payload (Mirai)", "value": "0d6150907eb9121eef9ed99cabf80da10a7861991c22b67b8f3da419d6a58719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883793, "uuid": "83fc77a8-e2f2-43fa-b5bd-bdb810b10b79", "comment": "Malware payload (Mirai)", "value": "300cf4b96f2594c348e90081719dae7e92091ad3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883793, "uuid": "390b62f0-7f5a-4bcd-b179-2f6c5b33e558", "comment": "Malware payload (Mirai)", "value": "3ba1dcbf4973054a605dd9caf95769854f65233c65a3c679738dfbef2492950100280fb0083609171813b4956fb46038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769883793, "uuid": "6c0a0ed3-aa8b-4927-9c9b-6ead124f5de4", "value": "T166F33B13B7324F91D726D1720BB38B595AEB11821EE248D5936CCB143A207E9689FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769883793, "uuid": "4425f681-6bc6-48a9-9b90-b963ce21b5dc", "value": "3072:M6pd2Six/LLBP8VsxumMkJXYF84OWZCrfPq8pa:MYd2SeLO+VXWZZKCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769883793, "uuid": "f3444096-2e4e-4ed0-8997-1ac07e3aa427", "value": 167964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769883793, "uuid": "9bb36665-1f63-44c8-ae47-c28be02f0e64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769883793, "uuid": "2a7b1725-5e31-4aa6-80be-c5b44ce3b74d", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d2982e-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769861139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861139, "uuid": "46fdbf4f-72af-40ad-81cf-f7126ebd8c82", "comment": "Malware payload (QuasarRAT)", "value": "0f99c1e6d3335933698ac340629ad3c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861139, "uuid": "247e4341-5496-4bca-811a-ca55a7482b48", "comment": "Malware payload (QuasarRAT)", "value": "0d9949646843d57838274a8dc7c102dcddee46c5d829652f742acc8602e930eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861139, "uuid": "3712d127-040c-4582-a616-813bbc46816c", "comment": "Malware payload (QuasarRAT)", "value": "3ee532743aa7ef8dacc58ef5dd2af517fffc82ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861139, "uuid": "32099178-9f93-499d-9ba9-a34b16ec8dac", "comment": "Malware payload (QuasarRAT)", "value": "f5b7fb11a78e940f5f9e92cc361aaf60ec21a46fdb2814212b71e970bf336dd1f9545adb6614ddd6446ad6c366e8a1d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861139, "uuid": "5b00cee3-035c-4474-8adc-18b08ffaa27d", "value": "T1A1248D2973A10CF9E577513AC8511A42F6B6B8560371CBBF07A04B669F232D0AD3FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861139, "uuid": "fe717cb9-82dd-4846-8217-8c26bf780962", "value": "539237722fceb53d3658e52b0ed55380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861139, "uuid": "5fb4394a-7946-4c5a-8db1-747b308fdd25", "value": "3072:LnikjMXJIHGLHPgSSQtXuzbGX4oT9ZQmpZzWNh0yMroY495JQ:LniaSKHGLHPgy9uXi9SmpZzbohbJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861139, "uuid": "d65f9330-0c24-495a-887a-82bd4b58a4d1", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861139, "uuid": "b662265d-bc90-47a9-a213-6bcd5bbc3d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861139, "uuid": "64224a45-0ad1-429e-a0ca-3d29d3d0dfc0", "value": "0f99c1e6d3335933698ac340629ad3c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598ed56e-fec4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769877971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877971, "uuid": "97d8ce4f-4832-4fe0-b09d-35fd5b3b41f6", "comment": "Malware payload", "value": "767660322ed396f542c4873bd41b47fa", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877971, "uuid": "3d5c1430-d361-43d9-b0ff-97d5045b923c", "comment": "Malware payload", "value": "0e557e93e69cf258aa12fe3013db8623f6c3b195617401d602f18c26fa3a58a5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877971, "uuid": "4c1695be-dd43-4dd0-9e55-5fb0a9dd21d3", "comment": "Malware payload", "value": "4f91c30d185d81bfbb5b504fee60605e42928e91", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877971, "uuid": "c5548295-f26b-4958-b84e-eea74a09300f", "comment": "Malware payload", "value": "ce9ecdb45826e1c8e52bf38bce738b9852403207f4ded5f577093615458c35af334db7b2b12983e23dad58f2f0b707ca", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877971, "uuid": "f215891a-08aa-4855-a116-9f034df1b24b", "value": "T1935168101EFA0258F37297356BFAB32288B7F851DA399AAD004D46441B73610E464F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877971, "uuid": "4b93ad26-586e-4d47-8329-41bac3a62617", "value": "24:8lw/BHYVKVW/s+/CWZIjHaogeHCW4evqdd79dsHT3:825a/jIj1geHCEvqdJ9y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877971, "uuid": "cdd471c0-0aa0-4bf9-8ce6-4db683530bd1", "value": 2876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877971, "uuid": "edf5043c-92b9-486c-a9df-2fb64890a833", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877971, "uuid": "80782c1b-4ef5-492a-84f8-363edd11e13d", "value": "GoogleReportExport.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5aa2485-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884622, "uuid": "2f5dc5bd-6296-4d54-af8a-9088fa0eea96", "comment": "Malware payload (Mirai)", "value": "a8190e7bccf875b19029a77f3f38b033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884622, "uuid": "d60857ae-8c0a-45b9-9ef1-1dcd7aac633d", "comment": "Malware payload (Mirai)", "value": "0e705b27f0f0a3e8ea9a0605a07935acdd3cf17ab283caeaf339a0c37d763c6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884622, "uuid": "7b606a1f-22e7-4ec0-9556-0f60be6a4098", "comment": "Malware payload (Mirai)", "value": "d4b00405215513082ccc3987952ec2cc83ae670b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884622, "uuid": "0529b9b4-408f-43b4-be80-7fb9d6b3495a", "comment": "Malware payload (Mirai)", "value": "ec9ccd7d435d1a782393355d22e3fa344aa7a1fed1be6ab1cd6a662cff6cee6920d6b0f62e63644e8f5bbeeab1612112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884622, "uuid": "9939463a-48db-4970-ae3f-2567ad773449", "value": "T1FD333B22AABC1A1BD4D0A63211A75367F0E61F494194D75FFD260C0FAF653502A7B7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884622, "uuid": "1136114a-aaa6-4e37-96a3-c32ab434965b", "value": "768:mYE27ZoWL4iH6JcHQyTrSEek1TDZvgkTYIJfEj8uEz8SdzVgGMIZxTVNm:mYBZPLNccxSPk1TDZvKIJfkMz8SdaENm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884622, "uuid": "b7e88d5e-7d5d-46fd-b6dd-f4513893bf97", "value": 52100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884622, "uuid": "9f21631d-d8a2-4bfa-bd35-4af54f266349", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884622, "uuid": "1dfd7032-01b3-4ddc-8761-2105109f4ec1", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5591d57d-feb9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769873240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769873240, "uuid": "20979119-402d-41e0-8251-ceba83999ef9", "comment": "Malware payload (Mirai)", "value": "3f5d152bc15752961717783018f80c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769873240, "uuid": "61776cce-0f91-4a80-b259-881839f79d39", "comment": "Malware payload (Mirai)", "value": "0e8185d83eeaaaec1651ce593fe6e2235fba58b9b94562d6fce374cf6822f1e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769873240, "uuid": "07ed1018-1d83-44e9-9bd9-5726086b256a", "comment": "Malware payload (Mirai)", "value": "1e44526446519048bc995a361674d9f2a1b996a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769873240, "uuid": "0ab50455-699b-4286-972b-5bb9bb82db5b", "comment": "Malware payload (Mirai)", "value": "454f3f6a41d40cb7cf7bfd202e879968cb174b70417ec00ce602ad737294c1dc512804ffdf75b6a96a66622d11375e66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769873240, "uuid": "5e009b3d-3042-44fb-8542-a9515c244c96", "value": "T1ED0429C7F900DEFAF80AE33748530909B130B7A104925A776257356FED3E2991977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769873240, "uuid": "571212a0-e922-4b00-8b87-f73952aad6fe", "value": "3072:SywEdBfj8yKQNmjBChFQyog0tUKKU0MtXX72Oo7HPqpNUqt9V3jbi1LI47aPzSJY:xRfAyoBtPKots1qtOLtYy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769873240, "uuid": "cd7c1ed8-673b-4243-a8db-97edfa9d82a6", "value": 177732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769873240, "uuid": "9501577a-1f7e-4186-b398-395f29f70d20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769873240, "uuid": "ff23315f-dbce-4be7-a2f0-d9c7eb406f20", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207f634e-fed4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884748, "uuid": "d251e31b-a606-489f-bfbf-6170fb0ce660", "comment": "Malware payload (Mirai)", "value": "fbc6715ce09e96dacd497a55fda02573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884748, "uuid": "5e11787f-3b9c-4de5-9ff8-376409d6cd47", "comment": "Malware payload (Mirai)", "value": "0f7063815de09e895e935f2792cf640bb6ef69ea03bc7c78bf6116b7fdf147a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884748, "uuid": "3037e453-73fc-4f2d-bc3d-f461db0e1999", "comment": "Malware payload (Mirai)", "value": "32643d40272cbbef55f690aabcca2935654699c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884748, "uuid": "6fe66367-79ac-4f0c-ac93-446d48aecabc", "comment": "Malware payload (Mirai)", "value": "58fc1aaa91279885389860aa46d82d5b2690e3907bc898d8caa91c3900486822358ce375b402d0db62300e5019674a45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884748, "uuid": "d5f91ca5-5155-4636-8270-4adbbb4aa13e", "value": "T171933956FD814622C6C116B7FB6E428E372313A9E2EE72039D255F2137CB91B0E7B581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884748, "uuid": "e78a25b4-a69f-49c8-9a18-37d734899825", "value": "1536:eStzlFnk6C3l83gGsOkqq94AcAEmjfa1TnMVKvBWv:eStzzk6C3Ykqq+/AEF93u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884748, "uuid": "64a59813-e92c-473d-b0a7-cda58840db64", "value": 91944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884748, "uuid": "237ccbeb-5817-4cda-96f4-4a21ced1d610", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884748, "uuid": "be79c2af-652a-43d0-803f-3ea719ca25fe", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85bf35b-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876869, "uuid": "0f7e2ebd-e676-4cda-a167-742d9dc01877", "comment": "Malware payload (Mirai)", "value": "63be2c9e53ceeaf9155ac4a25d8905a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876869, "uuid": "343085ce-4594-4fe6-b04f-9cfb59ef6235", "comment": "Malware payload (Mirai)", "value": "1044fbbb7dffeffc0254955a410928fd165165a0033920b470a7b8cb86aa48d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876869, "uuid": "f90a2ff6-c609-4128-8d29-7551d5de954d", "comment": "Malware payload (Mirai)", "value": "342b39b4505820b41aed24ecddd24eafcb6d5e9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876869, "uuid": "dc7db168-d2ed-455d-b41a-04f00d0a7548", "comment": "Malware payload (Mirai)", "value": "5ccabcaf11b90341c14fa1a2d88844f7cb93346a33428d0ee6ba6f0f11db69e6c9a751aa931688091704f19097ecb0e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876869, "uuid": "ffbe9a57-69a8-48bb-a45d-3b50c5d2115d", "value": "T1FA243A45EA408F13C0D717BAFADF43453323A7A593D7B306A924ABB43F8679E4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876869, "uuid": "475d07de-e44a-4a97-b7a3-3f99883809e6", "value": "6144:jdA5Aaw5hK1pCWU3NmaDTsOZWOv7wKe7GgrkwNM/Ruu8cmH2WBoB5n:jq5Aaw5hwW3NmaDTsOZWQMxKw2/Z9mHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876869, "uuid": "fb559e1f-4d38-4ba1-aeea-570cc8fc3326", "value": 221237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876869, "uuid": "2b3e2017-abf5-46e0-ad5b-a8b6d7b40fcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876869, "uuid": "873095ad-45c3-45cc-a7b9-e8c9c22b0a37", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d03072-fecf-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769882924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882924, "uuid": "57985988-3547-42c1-ac18-e0e28687c8fe", "comment": "Malware payload (Mirai)", "value": "747064b5671c4c585165e116a1dcdcde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882924, "uuid": "a87ba9d0-6ddb-4e9b-a190-c680a65570db", "comment": "Malware payload (Mirai)", "value": "121543acfdc5ff765919828578f63814fad67a9721766bcd721ab52a6a0df153", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882924, "uuid": "38688e0c-e34d-455f-951e-646b49514fce", "comment": "Malware payload (Mirai)", "value": "37800e3cb1a156da4e2eca0f3e64dbcfacebd047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882924, "uuid": "d70c0ac9-9a23-4b38-983b-a18a284eb6eb", "comment": "Malware payload (Mirai)", "value": "055da82be2287221a5ac124cca291a5a781cb542c345f5abe8d9c404b333f932a52ee412124da4296df712dd74a41fb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882924, "uuid": "871d28eb-d2d1-43fa-ac60-d014e45be97f", "value": "T1D0D36B76CC256F58C965E5B1F0318F796B63A954818B2FBE14ABC6788043DCCF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882924, "uuid": "4e56966d-0ed7-4651-a4f2-f7494cc2f676", "value": "3072:1WrUZgj07Zsawl0ro375vMTWZVY7OdQg:ErUZgm2awl15MCZV3Qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769882924, "uuid": "a73e5fdb-855d-4622-99d4-4e51536c12c4", "value": 138076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769882924, "uuid": "6e36b818-f747-4a29-ae73-02245f37f6c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882924, "uuid": "f1f241da-7fa7-4f49-ab42-b556cbf9f7bf", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0831dfb-fe81-11f0-a129-42010a9c0007", "comment": "Malware payload (GreenBlood)", "timestamp": 1769849395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849395, "uuid": "e30b347d-2f89-4803-a1e2-068460dae40c", "comment": "Malware payload (GreenBlood)", "value": "e760729dcee518659d9510ae1705db51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GreenBlood", "colour": "#598A7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849395, "uuid": "a07d343c-8489-4c42-bc10-394cc3042bc2", "comment": "Malware payload (GreenBlood)", "value": "12bba7161d07efcb1b14d30054901ac9ffe5202972437b0c47c88d71e45c7176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GreenBlood", "colour": "#598A7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849395, "uuid": "ef9c02b2-6522-4126-acb8-ad540a39b8b5", "comment": "Malware payload (GreenBlood)", "value": "f0336d1dad9615f3227bf7750d1cdfd3efa10008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GreenBlood", "colour": "#598A7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849395, "uuid": "bf81cb29-c128-4cfe-8ea2-260a802e7cc1", "comment": "Malware payload (GreenBlood)", "value": "9c8287be29f65d1347a4b71c4c6dd769be4118c54536360b7d0dfdfeff78d247c1e62c394f9cb0347ee1f52367d9e87d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GreenBlood", "colour": "#598A7E", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849395, "uuid": "429a0301-06ac-42d7-93e5-a2d568577e7c", "value": "T1E2F59D17FC9219A7C0A9B33189A252427B75BC492F3227D76E50B3782FB3BC09879754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849395, "uuid": "787dcca4-18d6-424e-a2ab-5fe49bbfee91", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849395, "uuid": "001995c7-353b-42b5-9f3d-9c6007a98066", "value": "49152:lA1+DzeU8ffq2TTiwa3f806jzy+4t2ddfwQv/QbZ51AVQzZ7zveLOlB:lQuAeMtYZ519vQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769849395, "uuid": "5c53e376-050d-4353-b9e9-3e016b60542f", "value": 3617792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769849395, "uuid": "a626a388-77c9-44b3-b2ef-6976a87683fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849395, "uuid": "833fbe72-474a-49e8-8fa0-d724b255a65d", "value": "12bba7161d07efcb1b14d30054901ac9ffe5202972437b0c47c88d71e45c7176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a1ea59-fee8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769893687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893687, "uuid": "d20adce1-b76d-4c40-a583-283513018386", "comment": "Malware payload", "value": "2efbbdde2138850bf48c057f85f2e92b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893687, "uuid": "372e4030-2698-4cd3-a778-b4a7c5219c1c", "comment": "Malware payload", "value": "1376308c463f31180b62648ba5e2515c460ca699859cd1a8c7629d48b751dd9e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893687, "uuid": "ed330da8-32b8-4d5b-8f6a-55c31606eee6", "comment": "Malware payload", "value": "3ac827110776d74c3b9531be5d6d9bc0349a8864", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893687, "uuid": "a09c02f6-440a-44d4-8885-1fdcc073faf0", "comment": "Malware payload", "value": "82cab3f1fa56925d3fd0dd3960bfd77a2b9304b44edadf125d00a43dc587b03c5f4abbf8e99d03feb19ef4988c34105d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893687, "uuid": "71f55b04-4fc8-42b6-9981-888b3e1266b4", "value": "T11E553387C17C18C44F7E06D7AFAF996C72288EFC100204766A6618AB253E75F87395DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893687, "uuid": "81dab56a-96c4-4ea1-818d-f92592c67b37", "value": "24576:XMZmoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRT:XMZmoZ9bq+MmMEL+hcjXHC/wnwdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769893687, "uuid": "0457b053-0415-421f-b5cb-914cf3b3a403", "value": 1394468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769893687, "uuid": "ff229257-1d72-45f6-b44f-ccd16c8ef85b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893687, "uuid": "acf6821e-6ce8-4341-a327-6076248f5acd", "value": "gif-svg-to-v2.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cddb0e-feea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894227, "uuid": "49333e2a-e9d1-4b18-b50d-f920ec7c8582", "comment": "Malware payload (Mirai)", "value": "d67d241a292820c06fb0e3c82df50dfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894227, "uuid": "b7d157ee-c088-4040-819f-dfb0c29b9009", "comment": "Malware payload (Mirai)", "value": "15bb9d9ae8dec61620e412df05368ab53f3cece5a93a74b4fc06341753b11e26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894227, "uuid": "8f909369-5447-4704-8b2d-09ace797a1fc", "comment": "Malware payload (Mirai)", "value": "03970727d669aff80a882f8bb23fdaa6f145f846", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894227, "uuid": "fd595a7c-7c47-4ecb-a701-5c868d5b33bc", "comment": "Malware payload (Mirai)", "value": "8eb31aa1bcbb70b070136ef54173eadd5574d98cbd9c51465b469d9530efee680a7e6272237c7ade3b90b7a946fc1b97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894227, "uuid": "a2cd36df-93d3-4a67-8b7b-ba937b6615d8", "value": "T1B0F2E1EE96DD5F0ACE6547372C5BAE875000EE4D68098DEC9FD83A16A0427755332983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894227, "uuid": "b2e4ed97-c633-4e4d-aa8f-46fda4239f42", "value": "768:rTwEpAK0nfLY43EzpHu1/6zMFG+3Ma4D8C6sUnbcuyD7UHQRjme:PBAKCxcuCMF38DI7nouy8Hyqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894227, "uuid": "0234c40e-68aa-49e8-85a2-501c7e3e119c", "value": 36803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894227, "uuid": "7cd1cd45-2970-490a-bf4a-0bc24e40b1e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894227, "uuid": "0d2ad78e-0e2b-4698-984b-0bf0b626b63c", "value": "ssh-agent-auth.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2a7e82-fe9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769859994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859994, "uuid": "0650953c-f062-445e-b73a-a522d3cbeb9d", "comment": "Malware payload (Mirai)", "value": "522e8a8529060fc68a60d9bd3efddc0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859994, "uuid": "97350af3-c8a9-425e-a52b-2e1ee0f586c4", "comment": "Malware payload (Mirai)", "value": "1630c0ac8b151b87303be177d5e88405bdfbb20c4e093e65a8c24183752889e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859994, "uuid": "5e285a04-1bbe-4d9a-ad96-915634bea187", "comment": "Malware payload (Mirai)", "value": "d178dac54a2cb7bc25b442f343e9092fc8cde727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859994, "uuid": "dba2ac5a-985c-477f-8539-bd08c0760c8e", "comment": "Malware payload (Mirai)", "value": "d8a2d0270cadec363426dfe606be1a810c254174dd84881a79a63c20779328feb21017db6b147b780ce0378010965d30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859994, "uuid": "e251fb98-16b7-4a9a-a00c-de69309d16ec", "value": "T1C3B2F132C24C8296E904C07F73DF44EC9058EC4C56ECEB44E3855EAAC6CF72258649ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859994, "uuid": "94ae7ebb-bd60-441a-ac22-f3646c709216", "value": "384:Mr7/nrMpDElILLu8xiaEjjzr0FK+0KNa80HvEz/Im6euZoP7WEbMZQZG9v1RK:k/rMGlIPPmjjQK+0KU80MjTvuueBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769859994, "uuid": "9835b17a-953e-447a-8022-fb29bff2e8e5", "value": 24184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769859994, "uuid": "63cba47b-3a27-461d-a9b1-11fc6cfe9c8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859994, "uuid": "e1bf35d8-d5ac-4efa-9e6b-730691b0800f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88016ce2-fecc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769881485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881485, "uuid": "78211752-8f22-4bd8-a465-4f902da042c0", "comment": "Malware payload", "value": "9ae401ec341ed1233f0eef7062dde565", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881485, "uuid": "201de2ca-3a82-47ba-84df-de0110a4d0ec", "comment": "Malware payload", "value": "166195cb65782ad68d424cd92a05c3f3ab1fd413d37d156688dd2028fd7f6c87", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881485, "uuid": "22a7e682-086f-4e30-8cab-5627e0f0ef7e", "comment": "Malware payload", "value": "07a6ccca086c40f9e8866e3a4601a87c1a3faf61", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881485, "uuid": "29b732d5-5987-486a-8264-a7c6b9a8ff83", "comment": "Malware payload", "value": "4f4f39d050f4b31adba566ebc5cc2672e275d21d5a5dc72bcd7088ac6c4cafea3e1fce65cfb2afd687cbde989e98825e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881485, "uuid": "58a7da5a-9279-4f19-8878-5c8eb0f93a91", "value": "T177D3E80876FC1A5AF8F3D7317AE2A2279531BEA045314E1D29CA1B0A3E31714EF5137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881485, "uuid": "9af2f40f-b725-44a8-b96d-e80e51e7274b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881485, "uuid": "edaa2a80-4279-44e6-9c0c-eb1a4fcca815", "value": "1536:3yxB2AdfjnymsVvkA9YtAiynO6ZGNsq6GjwwM5OKsO+I1QQYe5obM/NeA6wvv/Vx:hAxY39Yt36ZNGjI5Ob9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769881485, "uuid": "eda684f7-8c43-4a7e-a23c-2178c186dcea", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769881485, "uuid": "c752a22d-a051-4038-86c9-951753f587a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881485, "uuid": "a2366dce-b967-47ed-b25c-948a9e65da38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ea201a-fef2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769897860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769897860, "uuid": "8e68cbf9-94df-4ae2-abcc-25add2e6cad9", "comment": "Malware payload", "value": "1dbb8830512ffd4ed5069a8015dcf456", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769897860, "uuid": "b2b53eab-ab8e-4c57-b04a-067b2f6e92be", "comment": "Malware payload", "value": "16b13231372c7262a5ce13735e0c4e974af7e89ca20e7e94f1c79b0f4ba75910", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769897860, "uuid": "35467be9-0c54-4893-b3d1-99ca7b07fe48", "comment": "Malware payload", "value": "4580738aa73e72a1fe88b41e28a2a2fb841ab3d0", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769897860, "uuid": "981a3454-c9cd-4ea3-8964-8c04a053f37b", "comment": "Malware payload", "value": "2440b76813752f464b28fb48ce3c552ab3fa625d28728a7f81c289cefda3fd0d300b0a6e2b76f276c5579c026ba0e1fe", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769897860, "uuid": "35e4a804-072c-4c0b-97bd-455563005711", "value": "T1A04639AB32E485B9C11EC23FC4A28F40D4F7B1B50737C2E702911768DE668D56E7AA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769897860, "uuid": "87a07d7d-9ab4-4df8-94ce-22ffa61bc45b", "value": "07fba07802e4a95408526be16e22b7fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769897860, "uuid": "7709e563-40ab-49e4-832d-391905701103", "value": "49152:YlfUFv3+WavCTC1DtFSPzsSxuB8StMAnJuDyeMEO:6auX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769897860, "uuid": "12ce9ec5-a99d-4060-b5d7-61c2c9a3f101", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769897860, "uuid": "cb88acff-58d5-4e25-9116-10206af1448e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769897860, "uuid": "904ef7d8-971f-4e1d-b98d-035eb8542ab9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac4871d-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877195, "uuid": "1325c732-dbb5-4272-b81f-b110235fd0eb", "comment": "Malware payload (Mirai)", "value": "e422c9b24eb95788abb012010ce0e69a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877195, "uuid": "be94a98d-a331-45fc-ba7b-329aa80320e0", "comment": "Malware payload (Mirai)", "value": "17a41975fb5d6d6382886d276dbbb492357e22af1c2870c6a917340024467ed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877195, "uuid": "daadf2f6-3f7c-4faa-9321-88d0b48cc676", "comment": "Malware payload (Mirai)", "value": "a345c8e14d3b5f15be2922eb6a4a66f40eee26d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877195, "uuid": "18a8cb9a-baf9-41e3-885f-04dfe9bb79be", "comment": "Malware payload (Mirai)", "value": "13b2ad3af4b9bf64dc525db2d2be1cee62e6519879a209a177ee96296e0f56763c5074e5af10e5f6c5196a95752771c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877195, "uuid": "e8ebf490-0b86-4b84-ac97-38f0e2c3648e", "value": "T100C3D77AA7A1AEBBEC4DCD33018E5502115D924C92C96F6FF6A8C518E38BD4F48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877195, "uuid": "4e375fbe-01d6-4ade-bb55-8a914f661ec9", "value": "1536:vq0MEqX/hTBzVTe5WNaGeLPGHVT/P/RPTKlStnil:I/Xk5WYGeLPAK0ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877195, "uuid": "451a911e-567f-4b72-8349-cf640433a4a7", "value": 126711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877195, "uuid": "ab5a9687-8fff-42ec-a408-f72fd37aaa0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877195, "uuid": "b56ba91d-5861-4a5d-9590-2d4037f30f18", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd67878-fea8-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769866191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866191, "uuid": "ef39494c-4ece-4e4f-8be6-e26fe10219a9", "comment": "Malware payload (SalatStealer)", "value": "16c781156fb68ccf801f1cf15ddabfb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866191, "uuid": "5306da28-59a8-464c-8b00-5cf392a11910", "comment": "Malware payload (SalatStealer)", "value": "18c871a4c22e7b1beb5179784418121d92504f952fd5b37fd527d7bb615e32a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866191, "uuid": "89eee32d-b01d-42ea-8b17-28114b15404e", "comment": "Malware payload (SalatStealer)", "value": "a4eb9a1ddabfbc1fe025f91b9aa1ff998f51f250", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866191, "uuid": "7b0b3bf5-b12a-4c94-9ec2-f0bcc25665b9", "comment": "Malware payload (SalatStealer)", "value": "15a8eaf4fa5eda3993ca8acac9347550fb26f723505928b764f17299d5ee240800a9a9d9ce4f555a0bf8bd519e0d8d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866191, "uuid": "da12c55b-aaba-417a-87b2-d7d496c20669", "value": "T137B65B41FA8B89F5E9032832456BB27F23345D048B28DBE7EB547E6BFC776811C66205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866191, "uuid": "ca90867f-e749-49d4-88b2-23e9abfcec5e", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866191, "uuid": "0b056cd3-1293-42cf-bb1d-dec6fb613461", "value": "98304:UnkLHWax60KPEvTBVUfgZ8goFWDGwWxoURw:G0KWQf0+Rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769866191, "uuid": "7eb07758-52f2-4b7b-a4c8-5e50eba27144", "value": 11404288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769866191, "uuid": "ae3f1d3c-805a-4624-bf36-71ccac743dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866191, "uuid": "b73c636c-4beb-4369-ac60-96de41d2c851", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.16447.12491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd0145a-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855594, "uuid": "6e6a18e7-1212-44b3-b473-0f89cb3d431b", "comment": "Malware payload (Mirai)", "value": "171526c724f097a45daf80af7a891692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855594, "uuid": "dca39d3f-7d54-411c-b3db-e308b5900f0e", "comment": "Malware payload (Mirai)", "value": "1a686daae2fafab8362357d843099165bbd1a7410d4839f8d672bdb347de63f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855594, "uuid": "70614cef-5b2b-4b8e-9bf3-53ded7c103a5", "comment": "Malware payload (Mirai)", "value": "83f779b289851373a804f30c7db44b9b59485f0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855594, "uuid": "dbb16c4e-5fef-415b-8bab-ba63ba208a62", "comment": "Malware payload (Mirai)", "value": "294f897f72c793fd3f4d3b6bfb2f932fb2aa52c34864d1403ea3a02eb3bf50cf5957580f04b4e30092fd7cc184e637ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855594, "uuid": "ad3ac53b-3234-4bb4-aeda-17025e6ebd4b", "value": "T126D34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855594, "uuid": "5d41897c-24db-4143-b050-b4f40ebe325d", "value": "3072:lCldeCsOs9kzj2vV4XcZgqniE230IO1BlsT3jAA:APeCK9kzivVYQitymTTAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855594, "uuid": "d3c8c290-4812-45af-a082-c0f8f9af4212", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855594, "uuid": "b9a1598c-c744-4547-9e36-770d72db4798", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855594, "uuid": "eaeef0b0-bc45-415e-9bee-4be5d93676b3", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48336d90-fec0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769876224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876224, "uuid": "3b3f6bd2-b6df-44aa-bf18-bb1e9c9fc7c4", "comment": "Malware payload", "value": "0d349f33a31ca5bbd6c300baac8b2bba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876224, "uuid": "a4abbb24-2a89-446c-9ec5-fdf2c3ec8496", "comment": "Malware payload", "value": "1b12e67b189eb067a446f0dd3861ac294d95f97e146e772215412d7db9b42f04", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876224, "uuid": "84143bd8-5813-4e06-aa92-f55c4235dc7d", "comment": "Malware payload", "value": "31f34d191b9866f11b74fb411b58a7e2324d0720", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876224, "uuid": "3c5df2c3-e0a2-4879-8dd5-3c186d77634f", "comment": "Malware payload", "value": "627cd2375e414370bf21f72e798daf3b0bc2cac32dc75b50c5edffc744ed635d8e246c82259f1ec4a845d754fac00f8a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876224, "uuid": "1af2f596-a4b5-459b-a858-0e8aec2c5fe1", "value": "T1B2E312DF570915B4E479543F2503FD93B9603DC3489A0EAE992F2AB6A837C11BC18BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876224, "uuid": "7685b9b3-cea5-4f66-b46a-9003fce83406", "value": "5ca6a2d44a7cd2fb5fcd363d768c54ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876224, "uuid": "d9299d38-5987-48f2-adb3-c57fdc1342bd", "value": "3072:vwDTO6feHPoIRzNTWzyvcjVL/C02C6E09Say33zQSe86h1K4yGmr:v2t2HgQNWA2X2XE0IaynsSZ6xyGmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876224, "uuid": "d9621a2e-bc1e-4e3a-82bc-98bd11440642", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876224, "uuid": "779bceba-2d8a-450b-b17b-7727a9a99fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876224, "uuid": "4db3c16c-1282-4124-968c-3a06337f1c52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c342b364-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876860, "uuid": "6605804e-c017-48fa-ac23-592a2777c044", "comment": "Malware payload (Mirai)", "value": "54aebb36c20306068ffd01cb60205d06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876860, "uuid": "1223cb6b-1b55-4f50-9f74-d01a11bc4948", "comment": "Malware payload (Mirai)", "value": "1c5469a0ab355f819c26b21fd6d7d56aaca26a762d5822576a99c1fd313b382a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876860, "uuid": "d6872599-d05f-427c-beb3-921a94d6667c", "comment": "Malware payload (Mirai)", "value": "fd95b6a8fc0bcdbe6de2861ce9202675366a3537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876860, "uuid": "88492400-2c97-42e6-a110-002e7ce320b1", "comment": "Malware payload (Mirai)", "value": "87d33257c39e4c772c02192dd187f6288b264db8b8c84d89e516ef8bb14d2ea3c92eddecd5291307cadfab8a80b26af2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876860, "uuid": "3d44e656-9d60-49d0-b2ec-ea4fdc036dd7", "value": "T187E30842BD418F17C5C321F7BBAE468C3B266BA9D7EB7103E9206F9037864DB0936651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876860, "uuid": "54954248-244e-47f3-b1bd-4108664f31ec", "value": "3072:cz+Z3nexreWPOMk4PnS7TGF0ZQ69b6hh1XLwaC:cIKnWMk4fSXKWXsLwaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876860, "uuid": "2f38475b-ab15-4fc9-b487-2dc0bf255d67", "value": 156784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876860, "uuid": "d39ae41b-25bb-4cef-ba13-42633c3d140d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876860, "uuid": "21f0e71a-27f4-4b2c-b777-f75ec307e061", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ce6ba9-fe56-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769830642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769830642, "uuid": "e0d50c8c-47d7-429c-b6fe-7bbad39ea9d7", "comment": "Malware payload", "value": "718a1b05990e4198a5a0714b712d74ce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769830642, "uuid": "1874baa9-80c2-4ea1-9501-0e618efaf415", "comment": "Malware payload", "value": "1ca1dcc0e2faef0329dcbaaeafb3b6407b0083b5f6f8fb3c342906c69230978a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769830642, "uuid": "1035ecf2-510a-41ef-9b5d-688e3f7e4984", "comment": "Malware payload", "value": "5b8c34a6a46e7ed05b4d9a157f1eb2dc184209ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769830642, "uuid": "7002257a-b6cf-4c1c-8117-ca73ded65cb9", "comment": "Malware payload", "value": "13145ecad1a106f45dd6100de0d901ef2ee248aac4a7c0dfcebce9274ff3ede0bafa51158dd1cc6ee5e7a78cb5d28aac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769830642, "uuid": "d4eda1e7-e411-4236-8d57-0df23f60ecdf", "value": "T100F0E20FA04BF03AD08419E8EB61FB5AAC30B86B6373CE5C78417650FFD6424B8A2240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769830642, "uuid": "592cf92a-f7eb-46f1-a209-202b70020b2c", "value": "6:hLgjJ5Ja/+YcLN7+Y3JMF/+Ye0IdyJ44LIXLoO4eGLw+v+YdF/vNnQz2JMIykwFc:lSjkOLZpqjW3bo/8pqF82Q/NiTZA90t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769830642, "uuid": "9af85224-56d1-4007-9531-636252b63135", "value": 525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769830642, "uuid": "12c47634-a0aa-45f9-bffd-b7839fd45ea1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769830642, "uuid": "7b10b468-e943-4029-9ede-ff7cf71a9a82", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2734321-fe71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769842445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842445, "uuid": "c5d4f408-21c1-4a2e-928b-644837ba364c", "comment": "Malware payload", "value": "0cb69028662e33ee96a9fcf8af2461f9", "object_relation": "md5", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842445, "uuid": "b48e6518-9a1c-4048-aa56-e5eab4d27a5a", "comment": "Malware payload", "value": "1cfb90bb22218957d9165872dc4fdc5c5f3fefc19c4e977e0b110e4ef6d57101", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842445, "uuid": "d6aa79c6-cfa1-4934-9718-9497e916c87f", "comment": "Malware payload", "value": "0a886d4e2c1412f6c8c193ffb471241e793b1f0b", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842445, "uuid": "863b2e8e-2039-4747-b64d-abdde88a1219", "comment": "Malware payload", "value": "0566169c774a645997bea6d5a70dec905f9270148551d6b3bd04f70abd8889c0b0facdafe71367707f98e36313d5c38e", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842445, "uuid": "8bae83dd-9f9f-4ade-89c7-3bfe9eecd771", "value": "T1EF266C45E38000E2C9A7ABF6BDD21A62F574D111C72953B9A889C32E63DF5D407BF4E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842445, "uuid": "a5366ef4-78fb-4bfe-b5d0-1eec796d7f91", "value": "2c9c5138db65224d94ae75afcd29b2b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842445, "uuid": "35c143e6-4544-44fe-84a7-1121d187b90d", "value": "24576:ZWEpKOTmxNP8ZBrSoArfSjC4/b6S9O81YGu31p2zKC7KB0L:ppcxN0SohdPpmfDO2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769842445, "uuid": "92567985-81cd-4db6-9f61-c83f642c83ba", "value": 4775936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769842445, "uuid": "5e05b9fe-653e-462b-a0ba-28171e577c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842445, "uuid": "6eb7eb72-c31f-4a42-863c-11191c809322", "value": "1cfb90bb22218957d9165872dc4fdc5c5f3fefc19c4e977e0b110e4ef6d57101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cbebb5-fe6f-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769841426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841426, "uuid": "e9a6cd09-f053-44cb-a785-687a28b99b69", "comment": "Malware payload (XillenStealer)", "value": "5254c256820a0ca73c857bc426bb4dbd", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841426, "uuid": "08d4d00e-8425-49bb-b4c1-be0867f09d36", "comment": "Malware payload (XillenStealer)", "value": "1d1dae1a2cb2f8b1efcbb952722285946830fe2c0ce128d098c1f9e365eff4e7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841426, "uuid": "c574895d-3811-4664-a414-e95b06b10ccf", "comment": "Malware payload (XillenStealer)", "value": "7b64513e93ccda72c572fcc9a19e881c53f757f7", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841426, "uuid": "4f7cc21d-1fd8-4931-a9b7-1649dc65fa58", "comment": "Malware payload (XillenStealer)", "value": "0d90bee1898d8c9599c33c4058ea3df5fe799107f928b943662e8c3ae9b1e4a5cb3021a4164699eec760f2429c6541a6", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841426, "uuid": "dcd9e021-4cb9-4878-a541-d7a63a5034b9", "value": "T123F5AF17D6A285ECC17BD138C756A372BA70B85E1230BA6F2F58CB112F21F509B6E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841426, "uuid": "2eb83c63-417b-43b5-8628-e2a46252a366", "value": "17bea8a03957d0e4aa750e0183734e0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841426, "uuid": "b18f383d-4719-4b90-b894-d7071cfc6851", "value": "49152:5R86PkaOQ36cWfv+MkAX7NvvpnROlKXg1Nd8z52AkgIv1vD+fOTRomvEd:5R2BkAX7Nvcmwn39Tuk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769841426, "uuid": "9da872c8-8d86-4c9f-bb60-0884a80e939c", "value": 3563008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769841426, "uuid": "f89592b2-27bc-4e72-bd29-4613e326e7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841426, "uuid": "d3a20896-9125-4e85-aa75-d7dc746227bb", "value": "9a90af0b259b3f8fc6bfb3ef13536209b55d95e0d4da4eb819c1918c069a1d51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3daf0ab-fef7-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769900108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769900108, "uuid": "0e0a50e2-a877-442e-ac29-f1cb12e109a9", "comment": "Malware payload (QuasarRAT)", "value": "073f385aefeec02d4797df68d5d16f99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769900108, "uuid": "85c6d2ee-7f7d-43fe-a84f-f8c554f2db60", "comment": "Malware payload (QuasarRAT)", "value": "1dca871a9485fc5e894cdf39e563a36d015823bf4f28bb558ca18dbe7cfec959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769900108, "uuid": "389f766d-8d42-4669-996e-041658c63fa3", "comment": "Malware payload (QuasarRAT)", "value": "3f386816d6ec1f5dc696c12c60ddddc9e9471672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769900108, "uuid": "9c029cd3-1b05-499c-9a71-f6fc89484392", "comment": "Malware payload (QuasarRAT)", "value": "8229de061f410404880693b09d96b30882681e6a4d9bd8b28dd9af320088103cc11569d8c999ed9de938f5f280645d21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769900108, "uuid": "a92c2351-7143-4578-852f-ba24b7da736a", "value": "T101E56B143BF85E27E1BBE677A5B0041267F0FC1AF363EB0B2581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769900108, "uuid": "7467900f-e414-4edf-8728-408ff4683589", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769900108, "uuid": "e9bbb732-7110-4030-b07d-82795caa9c0f", "value": "49152:bvqG42pda6D+/PjlLOlg6yQipVs4RJ6kbR3LoGdyTHHB72eh2NT:bvN42pda6D+/PjlLOlZyQipVs4RJ6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769900108, "uuid": "ac7f009c-97ba-47f0-9257-8c214b162529", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769900108, "uuid": "e5831396-17be-4184-9dbc-bad3c0fbadd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769900108, "uuid": "facc8e71-b3c9-43b1-a39f-eac2049f742b", "value": "injecter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ccfcb6-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877676, "uuid": "c0589898-b389-4c14-b5a3-f8666f3f23ed", "comment": "Malware payload (Mirai)", "value": "93db27c4f020a89999a2a33a9f7b0715", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877676, "uuid": "4487c954-3adc-48d8-92af-834061857b73", "comment": "Malware payload (Mirai)", "value": "1e6a4ee419d25c51719fc42649d8dace40a9baba3f5d76ce46a9816fb73e5eb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877676, "uuid": "2731715a-4372-4845-bc31-29e034e93350", "comment": "Malware payload (Mirai)", "value": "3b019491324dc6d6fbc1e7c840dc69ce9b19cecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877676, "uuid": "33bbf325-a022-4078-b8a5-94987e61f40a", "comment": "Malware payload (Mirai)", "value": "fa35f2107b3601ee0d7dc3cb2ef59d55b0fc3e9b4798bdc023ec7d02fa097a95be84ef559eac9ad3f3aa66fe422e304f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877676, "uuid": "9082df1f-db34-4751-85f7-a09001e367d1", "value": "T11F93B5097FA01EB7ECABCC3746E9274514CE662621A93F75B930D828B10B65F26D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877676, "uuid": "c762090f-7993-4d93-af69-b50e827dd9aa", "value": "1536:DSqSdF3sGWoHCqLzynoonBiWcf9fHK25SGjlOrnXmgtMxZLQikoF1b:mqSdF8GWoHCKzyfMWcfjbGMxbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877676, "uuid": "857594aa-1901-4238-9031-913920b9af33", "value": 93032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877676, "uuid": "e201ccdc-a238-4f98-a34d-9e8925db6420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877676, "uuid": "06acc9bf-0d63-4400-95b4-a5a1a6f99331", "value": "mao.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf8ad54-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877197, "uuid": "b900f3d1-cf1f-4cc2-8c6e-8422f9f91690", "comment": "Malware payload (Mirai)", "value": "29eda5ffc23b319869b4319de75fd453", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877197, "uuid": "e726497f-a474-4c17-84ae-4891d1f25659", "comment": "Malware payload (Mirai)", "value": "1ea675e257f55fdd882823516f253a573cfb3f5737d4cc10004a293a0b094029", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877197, "uuid": "1f235fd4-f035-418c-b829-f4a9037805eb", "comment": "Malware payload (Mirai)", "value": "56ec59fb20d8897f4bb535794ed095a2d0f5dcc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877197, "uuid": "551a34a3-50d0-43a0-89a2-8810670844e8", "comment": "Malware payload (Mirai)", "value": "f240b0b0a942b223523e607fef17a53c7d3e196a9d47be7e820989a3a5bfd4fc658298fc77cccccf316ce11d5814b5fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877197, "uuid": "137faf75-9594-4d25-bad1-d925cec03df2", "value": "T1DC456C6AF2B371BDC057D030839BCB62A935F47511212D7B31C4DA352EA2EA41B1AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877197, "uuid": "c29cc9c3-ca37-47d2-adc2-f84b3ff42b1d", "value": "24576:8Wxd7ETOw3wigzVekNavsNqrf4Z/uy/ApRZ5i:lxdKOw3wig0kNavsN0fObApo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877197, "uuid": "62011708-f0fc-4d61-8218-6e7bdf9baeeb", "value": 1178200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877197, "uuid": "648bb93c-ac78-4667-b28d-0f75ed010206", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877197, "uuid": "bfefd7e6-16df-4e18-9024-92bd83db2c21", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3168b3e0-feea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894225, "uuid": "3dee6c80-5a9f-427e-874d-08add23055fd", "comment": "Malware payload (Mirai)", "value": "0c29ef410da60e551a11337dc5c45943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894225, "uuid": "284a16cc-8d93-4bb4-b021-971b643d6461", "comment": "Malware payload (Mirai)", "value": "1f35a705d6f3d89e5c68283380cdb4914d8300d6ac6410190278e06d628b90bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894225, "uuid": "5a0a98be-34d4-459a-9940-f0e73b0eb4d9", "comment": "Malware payload (Mirai)", "value": "1e3d25a774709e9be88d0eda11de187a3b1cd1f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894225, "uuid": "255c601e-8248-4f60-95a6-348045931875", "comment": "Malware payload (Mirai)", "value": "ea0c371d6e9a0fc96796be7a8d3953ada768c6934115296a7d7b8d1bef2265b15e00359214ee25c433a92054a416870d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894225, "uuid": "a27565cc-46a1-4cf0-a257-d6c4566ec44d", "value": "T143639E63D4262E5CD55586B4B8B0CF380793E544C24B2FFA59AAC275E043E9CF61A3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894225, "uuid": "91684efd-caa0-4765-b0cd-0c8967334283", "value": "1536:3HsWifphdilAlhefrKdIRWmkKlUC7eHHCJ4GB:3MvfHSimOdpKlU/nWLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894225, "uuid": "6fa37ab2-401a-40c2-86a3-a479441a9c8e", "value": 73347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894225, "uuid": "f224a79c-d97b-47f7-a85d-311e9a15b3cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894225, "uuid": "f3f5f574-dd75-4787-9289-a09d35491d18", "value": "ssh-agent-auth.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6554f57f-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769861241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861241, "uuid": "c0168573-a39b-4780-9ea4-c027033865c6", "comment": "Malware payload (Vidar)", "value": "6ead4cb080efd3834e02c14b9714f57c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861241, "uuid": "2bfb041f-421d-4a26-b6d4-0f2b8ed56848", "comment": "Malware payload (Vidar)", "value": "20bdd8cd7493353efe6e8c94782b0315b68de4d7846ee4ec96cfc4706b4ef1ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861241, "uuid": "6d4cf9f0-cbb3-41bb-8258-5f3cd1fda8dc", "comment": "Malware payload (Vidar)", "value": "86ca3d529219f977c2a17a92bb6ac19e39ee560f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861241, "uuid": "d020d9ac-e9ab-4070-80fe-c1df971c663e", "comment": "Malware payload (Vidar)", "value": "42071908f48d341ce7a715d32f6f4828ce7542ae22d6eeb7cba126818f4711e2c0d5c986d3135afa0286f93d2a715673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861241, "uuid": "ab614ed1-e6a2-472b-8f78-a6132c699518", "value": "T1B904128ADA14CA3EF87B85F53629463159AF0C8BF61002C5761BBC56422F19CCBF1A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861241, "uuid": "78619bd2-4302-43c0-952e-96c24dcabc13", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861241, "uuid": "dd071499-8015-45ff-830e-a1bd890ae93d", "value": "3072:1ahcZTytaqVal/aRGQb/+bRzHW35ihUlvVnFBYT9fNdKvaUbf14h26o2deFspCXP:1aiOtaqVy8czqEhavRFOvmaU7R2EFgC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861241, "uuid": "33440266-783c-4627-afcf-4df64b8481cb", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861241, "uuid": "a02f7c68-6ea1-41a6-b019-dcf9dabaa946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861241, "uuid": "04e93b61-5f1a-456f-b3ce-5fb313216996", "value": "eNLe4nm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5bbdb7-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877679, "uuid": "183224fa-037f-4f25-ba9e-b9989ddd21f6", "comment": "Malware payload (Mirai)", "value": "cb0179ee079e14049d0514f81539bb1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877679, "uuid": "71e6f46e-bbcf-4755-8893-3b8e366694e1", "comment": "Malware payload (Mirai)", "value": "21fd5b0561383fa90237da3d6affa587530664784e39f7e5896efa144c28e679", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877679, "uuid": "eacb3ce7-f8f9-48f2-9b7b-d01d5d8b8bf3", "comment": "Malware payload (Mirai)", "value": "05ba8b990c026ce031e1c14ee1d46c2c7af73bd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877679, "uuid": "02899059-5654-4e1b-b876-2bd0ceeaadc7", "comment": "Malware payload (Mirai)", "value": "6e9e2752fc4d81138c224a95cf4ca7f68e26e48287250d666e6c86bfc42a415444bd3f37cded5ac667fb452b09fc3bd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877679, "uuid": "861e575f-6d92-4765-b611-179b099f507a", "value": "T130632782FC81D902CBD4137ABA6E51CE33217399E2DE3247DD126F213B8A95F0D6B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877679, "uuid": "fc3a54e4-52a1-47d2-94fc-f8a495afe158", "value": "1536:M5wiLLhgCua4bJNYqhrFTbaS3W58nD1Jn9hYFL:M5wiXSCErxts8nHn9hYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877679, "uuid": "a6afb37d-3b3e-46c3-866f-a327f79c4042", "value": 67108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877679, "uuid": "227a0981-ca91-4963-b285-110179162017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877679, "uuid": "1dba6af8-cd35-4973-a61b-d9de5e8c217f", "value": "mao.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6d7f17-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884632, "uuid": "f2e3795b-cac3-43a3-9d3d-d63c6f22c78c", "comment": "Malware payload (Mirai)", "value": "9d113df9fa165e4b04dad60c03a53996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884632, "uuid": "a7a8b37b-af25-4a58-8f64-505a45019be3", "comment": "Malware payload (Mirai)", "value": "229039a45917eebfc79794920a061d7019f1d1db680f7bc4c3188764337ef08a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884632, "uuid": "7ccc7aaa-63b0-4dec-8903-ee3a90a2af80", "comment": "Malware payload (Mirai)", "value": "339303c00ebada9ebf5f02cf8302490b164491ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884632, "uuid": "63183e6d-6e52-4e32-bdf7-3f3194e0a989", "comment": "Malware payload (Mirai)", "value": "568822a9d28b99fe5773ff9bcf34957980c3819454de4e843a6c4bb78951ae72bd1eeea36b09b50f91ac87ad1a134784", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884632, "uuid": "9a98eadf-4a59-403b-bd53-4986002c1d4e", "value": "T110534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884632, "uuid": "575eeaca-d5ff-4dbb-995a-43a408482e29", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQ5QLiKimfFoktCe3fYRMR:WShU3q7cEDlCK/0D29i8Fok06fYRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884632, "uuid": "9006b2d4-b3fd-424c-83dc-39d6e778c159", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884632, "uuid": "f72c4582-eed1-4044-85f4-79e7f5e613bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884632, "uuid": "f51b2a77-72f9-4f53-8f85-75b4c6987053", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d41d5f-fea7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769865568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769865568, "uuid": "348e4b13-060b-4fb8-8e93-7003d4bbf302", "comment": "Malware payload (Mirai)", "value": "9fb7c680fab4b1da4f6d63e67d9c251d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769865568, "uuid": "3cf761e1-e266-48f8-b476-afb3911faa05", "comment": "Malware payload (Mirai)", "value": "22fb09fe5fc0f440196ee1490bf38a4392042ec0757778a99785ad9d94e4dbb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769865568, "uuid": "67c98e74-9ed8-4eee-9098-9275fd49c92b", "comment": "Malware payload (Mirai)", "value": "92dc0e951b6f02b01464b6b7b69fa490cf7e3e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769865568, "uuid": "1bb8146b-30b7-4f28-9385-19500f0b3cff", "comment": "Malware payload (Mirai)", "value": "971b90a9105e969523a4c5299a2e83decbd8713542412868824fcf5e52171cdc05c04e85a54e148b71ebac6140063284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769865568, "uuid": "dffa05ff-36f9-4f17-ba28-809d3cc7dcc0", "value": "T1B8056C4BB2B374FCD057C53443ABDAB2A935B42502226E7B65C8D6303E1AE701B1DB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769865568, "uuid": "a6432b46-9a69-4bc2-85f5-077ffeccd9ca", "value": "12288:D9zowsf5fFi4spVD/Gk0qy6/EoUlvY9v1vqtJ+fpp98AgeidzuFR1JykdLhS7WHX:DCwoS4suk0fAMw9dvqtowAeSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769865568, "uuid": "9d8f152c-181e-4d80-8e45-09e1d52b74b1", "value": 841384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769865568, "uuid": "81ff7285-55cb-43c7-a091-e4da29a7b675", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769865568, "uuid": "9f6fa909-412e-44b2-ba02-197dad3015ad", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ee46fd-fed7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769886374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769886374, "uuid": "d10c376e-33f9-446f-a1df-39db787877ac", "comment": "Malware payload (Mirai)", "value": "5f9a90c38d433768d690a30007ea878c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769886374, "uuid": "d101a72b-f80b-4f0d-9c2f-1c1b97acfc7c", "comment": "Malware payload (Mirai)", "value": "2668d47cb98f8ff80091d5f2b9bc87006aff75a35c4f675373ecd518f5de2633", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769886374, "uuid": "3326079e-fca0-4e8e-a7d8-72718ac84ac5", "comment": "Malware payload (Mirai)", "value": "9a390c4ff78c1b00c0825f66269ed037af80c431", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769886374, "uuid": "ac3e2919-28e1-4810-ae30-67323fd18eec", "comment": "Malware payload (Mirai)", "value": "c1d975cd502a5e4b139f27e75afe165843d5bd244c84ae237ebf1fb6d1ab1dd6ee79d45b23d178b0b230ffec9c37f754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769886374, "uuid": "aeea861b-fb83-40ff-8e1c-b8f7b4557c1e", "value": "T122146BA9BA0F6C41F2C2D3F9DE4C87E13E1B35E3C7368971791212EDCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769886374, "uuid": "324bf5a6-7e46-4264-8081-2c1e23ff8cfe", "value": "3072:D5GUm+DejTfd1l03E6zjceC0hwO9s7kroSioRUlMVWQ7oq:8Um+DoTfd1loEOj/C0a7kUcUlW7oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769886374, "uuid": "e1a564d0-cc8f-4d9a-b60d-e1d10e24dd93", "value": 206832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769886374, "uuid": "177f1dee-2def-4cba-ab0a-c56b0aec7942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769886374, "uuid": "a81e81e1-a6b1-4e08-99fd-a73c4de6ce30", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c28ec7-fefb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769901633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901633, "uuid": "7ff53aec-35f6-40c2-8b19-6f784d2527f4", "comment": "Malware payload", "value": "cc767ca97c495638ac7b57e2e0634e36", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901633, "uuid": "6d4dd74d-56c6-42ee-9f59-3ffbf6192103", "comment": "Malware payload", "value": "27c0ef1769c0dec264d62c1fe045295df2ab7db3ee7eddcef84b3b647d55130e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901633, "uuid": "c8e314fd-32a1-414c-b8df-2fb3b6cffbd0", "comment": "Malware payload", "value": "035e0cf9f10df045b4bc0d4aad5d60df3abc1592", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901633, "uuid": "bac6d31c-82fc-4b1d-a043-b4294a7c49c1", "comment": "Malware payload", "value": "b0d0616ab11aa022d9cacd0000c6bf60b7ff472ce41ec08587af79378aabe7aacb450ebd45436baa5c3daef348eeda12", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901633, "uuid": "faae52a0-09c7-485b-9583-fa6ab0e18d55", "value": "T158C68F9E98F44198C62BF23021725F697B31345C3721ABD739F8A0A769A5AD4D13F338", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901633, "uuid": "7df5f1d0-4d73-489e-9d00-04f2d2f1b1b3", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901633, "uuid": "03a3ac37-69cb-4eb3-925e-808915b458cb", "value": "98304:9HSXvQmSlXHEm5TRpn+sknZfEgZkDCkrfx3K:9HcQ7L+sMBTkDFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769901633, "uuid": "d977c922-87f6-4f7e-a9dc-e455a6f34430", "value": 11836032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769901633, "uuid": "734a43b1-ce19-49cb-b03b-e199edaf84be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901633, "uuid": "5d843102-3368-411e-baaa-2dbcec244bf7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081fafc9-fe58-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1769831449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769831449, "uuid": "b1ae02b9-484d-4ba1-8dc1-d1e88091879f", "comment": "Malware payload (Stealc)", "value": "60fed38c829e9d3fe73fb6847f9fd74d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769831449, "uuid": "19e2798d-ce35-4b36-99b5-527e4f613684", "comment": "Malware payload (Stealc)", "value": "284e20e568416dc0d28e06c327ef161cac60d2d04aa6af6cf895dfd9869c9b23", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769831449, "uuid": "37672d88-acf3-4910-b9d2-b1d2f3eea637", "comment": "Malware payload (Stealc)", "value": "66c48219bc12ad0ca8135730f7cdb5aa64be49ff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769831449, "uuid": "efe98911-9010-4407-be02-d015fb4deaa7", "comment": "Malware payload (Stealc)", "value": "567158d6fb55c2c8ca94cfac06f13a0f61bbd91f370adf9fce38060cbbd41698530219220ba56642b9d2c8773fe8444b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769831449, "uuid": "47194f14-58b5-4481-97af-85bce772a2b7", "value": "T11C465A32B89545A2D67FE2349460739172317B9413313BE36F98166A0D7ABCC273FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769831449, "uuid": "d0b97397-44f9-4ec0-a705-d60208f4bbbe", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769831449, "uuid": "723726f3-ca81-44ce-ac94-a85892f302eb", "value": "49152:izK6w3XVKX35qNBDwpVmHKnB7f8pupgzSNE3WiDUd+/w5EjuGjJK1OAdlupgzSNB:+w3XVpwmqxUy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769831449, "uuid": "84b07ca5-7f89-465e-8af8-9b8b28359802", "value": 5557888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769831449, "uuid": "35ae3cc7-23db-4d35-96e1-fc9b09577c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769831449, "uuid": "83365363-b01f-4dd0-9739-e9de07cedd3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7f8dfd-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877683, "uuid": "752f89bc-567d-479f-ad4b-4a7b01b47287", "comment": "Malware payload (Mirai)", "value": "1cc0e471918268be3d9dc704b2dfcc48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877683, "uuid": "651b0f1a-feb6-4b95-a42e-dedd9d03d85a", "comment": "Malware payload (Mirai)", "value": "286bec72def7d4044f9b2a1ce818b88fa3e4f34d1fc99239daba332208ebc357", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877683, "uuid": "82dee4d2-a4ba-4c3d-94db-b97e470516d6", "comment": "Malware payload (Mirai)", "value": "24fda2ea26708cceb9044b15884e9413db1b8928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877683, "uuid": "6872c67b-62be-44c7-9d65-ea1016a9c984", "comment": "Malware payload (Mirai)", "value": "212546401d9436b3e071fd03ca48ea94729ae703fdfcf9f6ec50c8ada07dd34316d6812a16afbbb80d9d95a58139a14b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877683, "uuid": "7f71f817-39fc-4cf2-b19c-cf376dae3168", "value": "T1D493630D6E328F7CFFE9823547B75A65960C379636E1C688C1ACE6011D6024F742FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877683, "uuid": "44eafb29-9c0d-476f-a901-4f168ff6d40d", "value": "1536:LENN50+XonVGo7RLh1nP+alhuyMZuo8BjluS2Oe/3FoI:I/50+XonEoRLLP+Duo8BjluS2V3Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877683, "uuid": "50d9ac74-c91d-4b7a-b01f-a47cdd569969", "value": 88936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877683, "uuid": "3aed92dc-d165-4907-bd24-51097032ee45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877683, "uuid": "c7a9fd81-f7c9-4e34-a160-2f58a3cbfbaf", "value": "mao.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f561854-fe6f-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769841420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841420, "uuid": "88209a04-60df-4aeb-a2f3-29af328371a8", "comment": "Malware payload (XillenStealer)", "value": "e3bb11fc2c0227615b6ee73308d99c54", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841420, "uuid": "fc60e385-4f98-462b-a2e5-6615d1a53482", "comment": "Malware payload (XillenStealer)", "value": "2ada7b2a659f9eb0afd6991b7cb0e81d9d019fd69fbf14b2fb208da65ac00ab9", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841420, "uuid": "dac4416d-4407-418f-bbbc-6f0ba0412d6f", "comment": "Malware payload (XillenStealer)", "value": "1589e2d0f71ebd504a9d157c2a358e7805bbf881", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841420, "uuid": "7ddc8f80-078f-42db-baaf-df78cde9f9ed", "comment": "Malware payload (XillenStealer)", "value": "b2e668568a79f5951ad369669e594d2d3175625939e83874d787e0ee17b22f2987e3892ffff7013c9012a4bef809bffb", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841420, "uuid": "42c0e00b-6ccf-4867-a6d6-98feba9b0a35", "value": "T1B28533229076A771FCD6D879D01B572CC311A85D04824DEFEA31CD3BED18A9A60B9F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841420, "uuid": "53428d1b-b758-49c9-860c-54d3e1da0ff9", "value": "e0a2c0168120df22501a39283b15736a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841420, "uuid": "6667c1d5-5bf6-4fce-9a17-5c80f9bda0c3", "value": "49152:aFErqOzps49nWPwHyIGoeoG6dYpgdve8eKrZMQbA:aFE3zH9Be/d6le2r6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769841420, "uuid": "abfca429-9f8b-4b6b-be4a-297c3d906f01", "value": 1802752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769841420, "uuid": "2bd31bca-1e22-44d2-b2c2-9d9178309b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841420, "uuid": "279df357-57ac-43e9-b8ca-e5cd2ea5ace7", "value": "457a0866fe8168d38ad9d98952c33d2dbe79b4d6109ee9e2f684679b40201553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acbf5d8a-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877681, "uuid": "a2f9d478-ff62-40fb-84a7-7c2d83a9bf6a", "comment": "Malware payload (Mirai)", "value": "a896bb38b0c8fa33e9409b9309a4f63c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877681, "uuid": "b7f47abe-ea14-4db5-be8d-c0993087f7e9", "comment": "Malware payload (Mirai)", "value": "2b541bff6d90991ed882c039587e3623acecc9c3c32a522b69a496bc50afbe30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877681, "uuid": "f668ebd6-0469-4cd9-a4c9-72809982e587", "comment": "Malware payload (Mirai)", "value": "00fd391d0f9574e457c7436eb8211b0f1d560c4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877681, "uuid": "d0da2fb0-56b6-4cce-b417-e95a8d8cd6f1", "comment": "Malware payload (Mirai)", "value": "83e63ccce949092afd619690aacff987a791761e6d6af66d9b5a838020e5c87792652fce1ec260270683654a92d2467f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877681, "uuid": "80ba3faf-6d07-4983-8a56-5ef18eaf197b", "value": "T131630AC4F98781F6CA1B4D3091B7F23FCA31D9798170876DEF9AAF35DA279029112189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877681, "uuid": "e26c7136-16b5-472c-8d02-bed25d3d2325", "value": "1536:Um9/coD3ZIK8SQIGcmhjsXZel7tjgZdGeOv:Um9H3GK8SQrcKj/lN4dX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877681, "uuid": "33105f37-997c-4090-a4f6-7451eff74c91", "value": 67248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877681, "uuid": "2ad43520-d32a-431a-9bc7-46309b289f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877681, "uuid": "0da08dcb-22b6-4b99-b3fe-a96d97c6b8ce", "value": "mao.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc6c3c3-fed4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884746, "uuid": "e81562ae-334c-4095-96ad-2b27a63db3b2", "comment": "Malware payload (Mirai)", "value": "3669b030c20122dd2579dc832e769a19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884746, "uuid": "3da9869a-d9db-4b84-b1b2-1fbefed60bb0", "comment": "Malware payload (Mirai)", "value": "2b570433f2a9787db0e88c45d7e9221448de2964ffcc30844d8d8f820c4b2372", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884746, "uuid": "1e8ad560-a92e-4426-8dc2-d74e854f7799", "comment": "Malware payload (Mirai)", "value": "27e34f9f7989d55264b0adbf3c79b0f70be8ac90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884746, "uuid": "53b4f857-1a53-4a89-89ad-9d12d946726d", "comment": "Malware payload (Mirai)", "value": "b86e2ae94291ef375edda8c39c8947caec75b8687cc729b49b9dfac22c10e69804a42d4042a9798ef7021c63c23cd456", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884746, "uuid": "ce5a861f-fb72-42f5-83e6-33e56b89db5a", "value": "T19A637EC9E287D8F6FC1705706036E73BAE71E0AA211CE686C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884746, "uuid": "a07e12c6-2af0-4a28-b3e9-dd25e7dfb556", "value": "1536:pnUQJZdRlDAXO6QyQwOaOAOJxAxhP2J7RvsuIr5bhR8s:pnUQJ7RlUXTQpwOaOAIxATPC+uWEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884746, "uuid": "cf074f4a-d9c4-489a-a982-5dc82f4e46f4", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884746, "uuid": "edaf6a73-acbd-48b8-89f9-39d97dfd2cd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884746, "uuid": "49f469b5-6bad-4ed6-b57e-3ea74c9b2be9", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437cc861-fe82-11f0-a129-42010a9c0007", "comment": "Malware payload (Nightspire)", "timestamp": 1769849587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849587, "uuid": "fb55b106-cd0f-4978-b19c-cdc8cd97522c", "comment": "Malware payload (Nightspire)", "value": "d0a8b47c099440abaec8abfd7c12ac93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849587, "uuid": "aaa8afa3-a6ae-42c9-9537-81551efb2ce8", "comment": "Malware payload (Nightspire)", "value": "2c3f8889c9f5d765632ad91b4cc2a852c54845e143dbd2b68359b6f9cdfd8f99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849587, "uuid": "6827c4d9-5628-4f51-bd86-400b847089d1", "comment": "Malware payload (Nightspire)", "value": "f778f6f9c5abb625b0083457a8d7b094464bec5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849587, "uuid": "a4336aca-1a80-4c04-acfb-918d53563a42", "comment": "Malware payload (Nightspire)", "value": "a1e9a98d4965a7d5e0713c157e102699e3cb598953b83ac31f3206adfdab9cefce78e5f8955965e8b0f84d9376938a28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849587, "uuid": "9507121b-a290-45f0-9b7b-7360b5152766", "value": "T19CD54C17FC9669E6C0AAF23089629152BB617C487B3163D32B90FB382F737D059B9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849587, "uuid": "944ed6e3-9c27-4f61-89b8-dc46da26719d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849587, "uuid": "4a8c8f4d-c535-45fd-9ac4-397309879e30", "value": "49152:O2VXRay3Yum9DRKw2SFFyi8LB1KxK9Kx4w5E:ONHL/CGDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769849587, "uuid": "82977f53-0a38-44a2-8360-fdd1ffffc135", "value": 2987520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769849587, "uuid": "eb151aea-e84a-4806-9d2f-fc3c0c538904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849587, "uuid": "71407166-17d7-4bda-9847-2d775b0be94f", "value": "2c3f8889c9f5d765632ad91b4cc2a852c54845e143dbd2b68359b6f9cdfd8f99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212a793a-fe85-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850818, "uuid": "2bae729e-e88c-414b-9777-c46cecf0e1d5", "comment": "Malware payload (XillenStealer)", "value": "f78242d89cc15c378beb340f9e005a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850818, "uuid": "be797a1e-fd57-4614-9fd5-a2ccd25bda7f", "comment": "Malware payload (XillenStealer)", "value": "2e481b9e4d30d776715abb6393dcd55ac99a808d9b929f909a8c5d07deb87ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850818, "uuid": "040b7b08-d112-4263-8b55-97dce7900cf1", "comment": "Malware payload (XillenStealer)", "value": "f49f551c2480d432d747f9621c780005576b7c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850818, "uuid": "ba37fe6a-e892-4f21-bbfd-a70e7b7c375c", "comment": "Malware payload (XillenStealer)", "value": "47c1bae4b5352ff788cbb5448a52765ed8406697937669aae995f341dc450239e13ce39dd19029552ad4af8cdf08f90c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850818, "uuid": "9d4e1151-86ad-4492-986e-f07880ed3606", "value": "T1EF060233B28A633EF06E5A3759B2D2605C3B7A61A51F4C4696F44C4CCF2A0A01E7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850818, "uuid": "80a1502f-9bff-410d-b4d3-39a011a6495f", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850818, "uuid": "2b1b0e8a-df44-40e9-a3fe-60cca00c95a7", "value": "49152:HN61T1mF25cCYiFHXNTSP1sZrIan6cyrMqFWNOcClaAN3ht55O7:HN66F8cClFXpi1gEan6X7FkOEAN3v5I7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850818, "uuid": "ca311ebd-a3c0-40e3-bbd4-08f88fb3c13e", "value": 3941423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850818, "uuid": "b97317aa-f6c5-4a83-87e4-ef5115c4c36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850818, "uuid": "d2e9ee1f-42d3-40e2-bc5e-40531d5cdac5", "value": "f78242d89cc15c378beb340f9e005a04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b876d216-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876842, "uuid": "b2647e66-48aa-459e-ad4d-f9f19390c314", "comment": "Malware payload (Mirai)", "value": "2a653f83fc4cfdb0d278a25b326837ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876842, "uuid": "77bd4aeb-7796-40b1-a578-eb3d04c2a5c2", "comment": "Malware payload (Mirai)", "value": "2faf6730d2a2f1d41b62763050900e9b82fb7e62df352624645b9064abc847ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876842, "uuid": "4d6e72e2-dbcc-4577-834a-9f9e01265af3", "comment": "Malware payload (Mirai)", "value": "670ec8c4681fafdd5c0bbbe595c74e01d3899a17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876842, "uuid": "3d7ee15e-b756-41da-bb38-61c52a50f9f6", "comment": "Malware payload (Mirai)", "value": "d253294e6e0d4070297deb4956f5a0f3279dfd24d378cc6ee29b6e767e80a23a9f567cdf93d4c9866bbb4624ef383abd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876842, "uuid": "35d68f2e-3249-4e79-bfa4-cbe018cff4ff", "value": "T165042B87F901CEBFF80BB2B704930D157530BBA618A34A37B1677DABAD250C81527E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876842, "uuid": "97c27302-df70-419c-a014-a291111035db", "value": "3072:iA+ExxaXuDleD8+X3wmFpKV9XPYQlVijbi2LRBz3DepytdNluh/FRT+Tphj7:l+Cw8+HwmfKf/YQ+Lr4yt1EQphj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876842, "uuid": "df81cd4e-b112-4bdc-a178-edc84e7897ce", "value": 175920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876842, "uuid": "24803d01-2d46-4287-896a-2d8f056dcfee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876842, "uuid": "53888bec-6611-4ee6-bb8c-c6d8c1cfc9ce", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a2efed-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1769861317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861317, "uuid": "0745d8f9-04f4-4d5d-b93c-31dd56cd7020", "comment": "Malware payload (RemcosRAT)", "value": "e434375dc50b0134e0d30856b189f468", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861317, "uuid": "fe140c2f-c4ce-41da-a5a4-83f7fc0fdf0a", "comment": "Malware payload (RemcosRAT)", "value": "30347a64996f1516686d0eea67a56eebc43454bcddf0822e4997a35f4761d106", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861317, "uuid": "1503cfb3-2ba4-42fa-a594-e618faa1f2eb", "comment": "Malware payload (RemcosRAT)", "value": "2dce3c82c85dda594b304f4bd1e8d24672e68617", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861317, "uuid": "caabee2e-e64b-4a1a-900d-be00b87c2b24", "comment": "Malware payload (RemcosRAT)", "value": "497d60d9f559ab453b6c6ca7d65202fdda6ccd616f80314f0b0f1b566c8ec28ff2554f6ff256d22ab9f7f0ac49d39de8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861317, "uuid": "8a3aff2f-ec2b-478a-b370-efcf158797b0", "value": "T12636126C012837DCE1E2412F4AA71A6BBE19E31D75575F1DB806ACDEB890E88D1D83CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861317, "uuid": "c3fcb6a1-f02c-4c4d-94c2-afd44736e2a0", "value": "3072:ogPIPYHPDs7/tJHgJ303ThuOCQeIB6cNoGwjB+zMtyz66:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861317, "uuid": "64c152f2-ec26-40b7-a026-96e4cac025a3", "value": 5010159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861317, "uuid": "3f6adf3c-0bd7-4f3d-919d-45713a86b455", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861317, "uuid": "e5a86860-a639-4f26-9a8d-208b8f48b78e", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f0a012-fe85-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850800, "uuid": "f18032fc-3a88-4f45-92d9-188db0cdae10", "comment": "Malware payload (XillenStealer)", "value": "da3da3a3772e334d379c87c0e702f830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850800, "uuid": "767396ed-a059-4edd-9c2e-6718c7e123e6", "comment": "Malware payload (XillenStealer)", "value": "30d934db3cf20b600d94a87b61625654c6de0ab5a6a23c92495402fdbb51862e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850800, "uuid": "038e01a8-6fbc-4feb-84ce-8b5ec326cc64", "comment": "Malware payload (XillenStealer)", "value": "c00390579f9b00a361d26fa62be1d9840135f311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850800, "uuid": "d986dbec-605e-4b1a-8b51-cde47d18836a", "comment": "Malware payload (XillenStealer)", "value": "de05b244c126976009c9e5c0d7e1eba4262f87928a43fa52757a9be058d3c47d8f321728477aa181d8e757a5b93cb0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850800, "uuid": "10efeeb3-7afc-4980-8dcf-37c15268d608", "value": "T1C5F59E17E66244EEC1A7C175861F9233BA30F85A16317A7F2B58CF292F16F604A6DF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850800, "uuid": "647b3564-2d0c-45b0-a348-0645f9f84a0e", "value": "ceca38aaf88246327be57ca0f6e1d1b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850800, "uuid": "d7c49a9e-e25d-4dc7-8674-961316eb103c", "value": "49152:v6iIVHIzoJupGzKevKLLKKaaKKW7c8rYnM52AkgIv1vD+fOTRomvEdc:v+IoBrIXn39Tuk2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850800, "uuid": "6e8822df-5ca4-442a-9ad3-c9acf4dc176c", "value": 3523640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850800, "uuid": "061b6041-fde7-4760-83c7-2eedf0cf77d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850800, "uuid": "11626b38-a48e-4d07-aacc-84d21c61e563", "value": "30d934db3cf20b600d94a87b61625654c6de0ab5a6a23c92495402fdbb51862e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30c283f-fefb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769901851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901851, "uuid": "d0636e3f-b279-487c-900e-a600ca4c3fa4", "comment": "Malware payload", "value": "4c30e2a5a9204553cd88ec280e50a9ef", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901851, "uuid": "ffe714aa-92bf-4e40-8c58-02f09c82069f", "comment": "Malware payload", "value": "31b717d710d3bd3925e8bcaa58f5acba3568d7523114cd4ce06443d38dd1a7d0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901851, "uuid": "52292da9-d36e-4187-9080-a01c412ddce6", "comment": "Malware payload", "value": "bc52f081433b9ac2b1f1e6a07ab1434382189f39", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901851, "uuid": "c9fbbefc-c484-4516-8704-ca36a912e283", "comment": "Malware payload", "value": "04a15c44f6b2a41cd269252fc672c811f07e91447b82bd8c6fac6a69cf3d0eb4224049411dc6cd3d966738ae61cf03c9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901851, "uuid": "0a7eaa79-aba6-427f-8b0b-f03425e0e3c3", "value": "T15E863352C7E74038E1DB4933A4AADC91DF7378B148DAB4662CB6D20C1A7C3C1AD3A795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901851, "uuid": "0fa798c8-0c3c-42e9-94f5-59be6d5b1d6a", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901851, "uuid": "2ac66197-c635-48fc-b555-25fc123f90c0", "value": "196608:k5O2zZxvQGIxfXK0Z7EPM1qjFTYGhYLQd:kfnIRXWE1qje0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769901851, "uuid": "87cf727f-22ac-4a33-be09-c46ca516900d", "value": 8204493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769901851, "uuid": "dd02fe36-c0fa-4ed5-acaf-ed6b2c1c8cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901851, "uuid": "e2cf05d3-c109-46c9-9238-a393bb0a6012", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3eb4bd-fed5-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769885328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885328, "uuid": "61d26cbf-9b60-4a43-a159-e1b31438f15e", "comment": "Malware payload (SalatStealer)", "value": "55209f0c96c3759909f7c5992c9949f8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885328, "uuid": "fb15bbda-cda3-4734-bb87-ff07b987f123", "comment": "Malware payload (SalatStealer)", "value": "3259083a3d9a3b1bb0cc9bbe388537f6fa558329c10984ca296da0eb8e5cf634", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885328, "uuid": "50e2375f-eb1d-49d8-9b3b-510f99fb9622", "comment": "Malware payload (SalatStealer)", "value": "66640606d40b0409b63ee0d4b7533e31b0c17a08", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885328, "uuid": "9e754874-c909-4767-a84e-3cd0d1f8ee48", "comment": "Malware payload (SalatStealer)", "value": "86f2b09b7d5c70a530171c33df390ce9ca90316470be989cbd34e5afde37f28a34583a60243b1ccb26b5e3d03e2b73dd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885328, "uuid": "48cbfa2c-d121-448f-8a18-e2ee4ec7c6f7", "value": "T16E4601140BE96EEFC9B8927D87EA733C84DD5F110211D8DFC0516FDA852FA83664A12B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885328, "uuid": "d1b4c695-4acd-43a1-8904-1209efb2e90c", "value": "0f367a195327083b1777236d7f2f32ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885328, "uuid": "dd41378c-aabd-4843-aa15-2b7ec729f6fb", "value": "49152:8jZMaFHPMbBChxKL9mOXDX4QlDAJOMR6FVoLlg21aiqr9EixHnRLJgzd9djMbCXi:8j+cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769885328, "uuid": "a3b796bb-6318-4cc3-9d26-7e53f5afffa0", "value": 5644784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769885328, "uuid": "20a2aaeb-eabc-4142-9e45-3b54ccb31d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885328, "uuid": "6a2c5781-0c69-4630-b306-5425868159a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0192cb7f-fed6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769885555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885555, "uuid": "9069bc17-81c5-4e5e-8de1-afc406d20544", "comment": "Malware payload (Mirai)", "value": "85f613d671af32a9950aa3ba32fd978c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885555, "uuid": "2a17baef-5a94-4d24-908f-1e029aa46101", "comment": "Malware payload (Mirai)", "value": "3274823989d51f00b22cc30168f04e379c5c177987e57f0fd4cfe0f00c53e442", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885555, "uuid": "29caf9c2-5279-4b67-82b7-979b75c7b060", "comment": "Malware payload (Mirai)", "value": "3a68405ee8ccea65f5bf5e4a20a9b5c7998a359d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885555, "uuid": "fbd9ced7-fbce-4720-b2d7-0934a9f5b94c", "comment": "Malware payload (Mirai)", "value": "85977ff6ffd7bfe9b1dc9d44bcb226cbef6f6a9912d30ebc897e88275da2286bf7e9ec352d4e6966263a34c93094e2d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885555, "uuid": "769aa328-d7cf-42b9-a3bb-3213326ea7ed", "value": "T114F45B02EF890FDBC4AFCD70456E834717EDC9D706D4A33451BC898CBA9E66A4AE3458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885555, "uuid": "101eb403-df47-43b4-ad1d-ecf182829263", "value": "12288:p3V3aI/gLuA9e8N5JCym6exuzYhnzuz0zTzNP/9l1siu8bA1O2G5+VGAQ5mB7quZ:hxR/6O+m44wSwY7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769885555, "uuid": "f97352bd-b4d3-47a7-9f53-102971c9d959", "value": 730636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769885555, "uuid": "fca04aec-1a5e-4eae-ae5b-4d7e3eb743dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885555, "uuid": "2d1b0fda-660a-4c90-8898-fbbe6a146cfd", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ef078b-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876833, "uuid": "d521721d-bc1e-4c43-a282-8cad0277255e", "comment": "Malware payload (Mirai)", "value": "c2d361fd5d75922ba4044b92a4f3ef73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876833, "uuid": "bae69770-426b-4de1-b99e-68a9b6f91e4e", "comment": "Malware payload (Mirai)", "value": "3406a744f369fa8743761b568a5904853eeb12ba732bda92478330b280fa3283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876833, "uuid": "5696150c-07b7-4d16-9b3d-4b7f595e9c4f", "comment": "Malware payload (Mirai)", "value": "2c038f93d17dfd743d1949702fe05bcab3aa2f51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876833, "uuid": "7fe09c2d-1723-44c8-a3b2-d393d0e9eb36", "comment": "Malware payload (Mirai)", "value": "27efd271ebb2b3e59c5ee1f9dc054e7b30db86c50f2d1027f860474d01bb53a057e3d4140f6f2a7beeea3fc68801b199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876833, "uuid": "f95f9ed1-55ec-42e5-aad9-53ac9e781b69", "value": "T1558312A5BB82085D9E52B77C0AEFF3DFA573C493158134075E0983681E5F361A2B2C2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876833, "uuid": "e8c1514b-1f8a-4d0b-8f2c-eef89a19b446", "value": "1536:sZrBFk4r4eKsEev+m9ocSf2bgS3xfXhrMsWLOSy3QMykkfLBukO5jjmINN:8rBXr4eSemIbVgSVxAU3sfL5Od9NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876833, "uuid": "48d100f7-5e82-4a63-9649-ace647260f7f", "value": 83252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876833, "uuid": "0208cf46-98fb-44bd-9965-f0797874ae6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876833, "uuid": "8e4ef951-1908-48be-aae9-9a29c9f0b454", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fd0140-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846798, "uuid": "2fed28ef-ff3e-4464-a46e-25868cee2801", "comment": "Malware payload", "value": "cbf3c84ac3fde9ba9525042e58d532f3", "object_relation": "md5", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846798, "uuid": "e49ea8c3-f369-42c1-90cc-124a5d4965dd", "comment": "Malware payload", "value": "35c3bd6084fe5dc9aebedc720c3d49aa42fa0de8dea6522f22a1b3314ae3cb8a", "object_relation": "sha256", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846798, "uuid": "36e6423c-308c-4f40-8794-966ad0d990c4", "comment": "Malware payload", "value": "3133b58769f73933f7b9b27a2122890a05d9aa1c", "object_relation": "sha1", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846798, "uuid": "f52b539c-0d74-4088-ac99-72703d178b30", "comment": "Malware payload", "value": "565fe179191f34e21cce12f1dcb2471115b09134e0af92215c502852e9c568f20c89061a934a73765a76b1c860da4aaa", "object_relation": "sha3-384", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846798, "uuid": "e2a9f27e-02ca-44af-bc08-86c9f0e4d12b", "value": "T105C5336600B05B7548C2504A26CC2BF3B139B3F98E42C617EE26FF6E496B9D4D9707E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846798, "uuid": "a4e17634-e10d-442f-b202-b9c737c3c821", "value": "49152:GGNhqTttl3Tm/qM9wmph9DhwnEAf/WlL1+LvPvYMkOb04JD33LtqNIBi5:BNsJLjm/Jjj9D2/fTLfYzsFV33g6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846798, "uuid": "a2057b33-494c-47a9-bcc6-d943c08f38c5", "value": 2513432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846798, "uuid": "7654a3a8-1cb4-4854-8e9a-1499a97ad9b6", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846798, "uuid": "1dc1bd69-af64-4bfa-b9b4-d0acce613092", "value": "35c3bd6084fe5dc9aebedc720c3d49aa42fa0de8dea6522f22a1b3314ae3cb8a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c88295-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876841, "uuid": "34cade10-b75b-4b05-ae37-f1a0808cfe08", "comment": "Malware payload (Mirai)", "value": "210259edd95dc0a5ec2e7ff21bc10606", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876841, "uuid": "57623072-cff4-48c3-8769-0d0eacb1a43b", "comment": "Malware payload (Mirai)", "value": "35f42e78296f3e8635799d75a697e44a0b3a2d1d53dd9507d29f05fcc54922eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876841, "uuid": "97826d56-72e6-4f68-9d25-49a1859ade83", "comment": "Malware payload (Mirai)", "value": "0fa5dbda97e800104df4f8bc1b7f0baf76f67037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876841, "uuid": "a0ffa83f-3077-4eaa-b36c-e17720e61ea7", "comment": "Malware payload (Mirai)", "value": "2ed591ab04e546e25b91a6baa2f1a2ff12bc76e947657978ed9a0b1580c6bbe800e651465e4a8c35ef021ed344eb583c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876841, "uuid": "c799831b-f231-494a-adc7-c0e6fc3bddf3", "value": "T112A31235B93B9493EBCE9BFF6061366DA0AF26337545817D02A03F95641A11F427E2F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876841, "uuid": "6553e9a3-5fca-499c-ae8d-e9939b1e338d", "value": "1536:PEaJW7fr9ihNkB9zAk3NRJ8a2OKhhiuM8e3C0bhyiGx8hkp5xYXunKQIPe/rd/Lg:T6r9i6D3NRJPvY0SaCz52sLepz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876841, "uuid": "209a0814-d37f-4c3f-a317-b5883493031c", "value": 105100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876841, "uuid": "d3340240-32c7-417d-9d7e-150d19f3d39e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876841, "uuid": "a288d6d7-03b2-4b11-8d10-8e5215039938", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14e20a1-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884615, "uuid": "441c6c88-a89f-4442-b53f-dd2e34a8d07c", "comment": "Malware payload (Mirai)", "value": "012ff2bebda965bd764c13578da6c359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884615, "uuid": "3d2c25e9-db38-4acf-aef5-ee66128f4625", "comment": "Malware payload (Mirai)", "value": "3726182fe34d112fa6c5b3c09d6f6404cc62e07953bfcea0187958dcb86a4e47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884615, "uuid": "947baa9a-6271-4a53-80fd-1d03ee91588c", "comment": "Malware payload (Mirai)", "value": "b21c6ec720a12bd190e03afb79f8fbc4dbcef5eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884615, "uuid": "c77ebf72-ad24-4f24-820d-3965acca63a6", "comment": "Malware payload (Mirai)", "value": "f75eda8a78e228b4b93c4ba8d93060e82876dd3e66d1b054067aff68dae6a17bf3bb9015ddbbf54d1e9ea7660320772e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884615, "uuid": "cef910d7-8a3d-4e7e-af52-fac1011c7b2d", "value": "T191C3AE87FB8714A1C46206F017C70BAD2B93A111CE5FE8E3AD1DB53B5E7A4EB1916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884615, "uuid": "e7452c7e-447b-4a09-a177-b20048d00979", "value": "1536:NaCCKd79UBQTXC76NWsbjkxLJL2cR0IJQiWlDrbD4rxslhBTgTyET/LWCs:N4K59UOXCAdfkpJL27IJ4pbD445g/qC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884615, "uuid": "9e2f6e63-0980-4cef-91ab-f57563c0a137", "value": 124672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884615, "uuid": "5a470932-2143-480a-9b16-fddf23920c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884615, "uuid": "c1e5ad4e-695d-42c1-92a2-8e210c182f6d", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8602f4e-fe39-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769818403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818403, "uuid": "56e0c482-a06b-41a8-82e2-39b37c89697c", "comment": "Malware payload (Mirai)", "value": "83c8e94398921a9cf5c31a2a34669c7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818403, "uuid": "fe57aac5-19bb-4b83-bc25-f0c6ba8ead0d", "comment": "Malware payload (Mirai)", "value": "39935d89e3af04bf1b3978b515ba4f2a8fc3995398a07fd14756369de09d7249", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818403, "uuid": "f1cbdf69-41fb-4b27-ad2f-eb3814fed688", "comment": "Malware payload (Mirai)", "value": "21169b0f72203f0700c9db0b0b00856923bc1877", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818403, "uuid": "9456d1b0-338b-4414-9098-43822a3d7576", "comment": "Malware payload (Mirai)", "value": "e63149b1a087760e127dac0a34715860f2160473b49720906fe458900feaee6a1ecf7a552ede35f741b944ff56f73603", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818403, "uuid": "88fc63d3-cee0-40a1-9841-28564fe17e80", "value": "T1B4A309C9BC859B11D5D536BAFE0E518933138B78E3FA7113DE185B2E638A86B0B37501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818403, "uuid": "3ddd0fa1-86d5-49c2-8964-de87b348c4dc", "value": "3072:zTT5OpJLwa9FENffoK7cl/LeBcqfej3C+k2PwN7KExZMX:I0aw4K74/29fej3C+FPwN7Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769818403, "uuid": "fa1c68d5-2409-420f-ae34-b4c12701a989", "value": 104164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769818403, "uuid": "4855658b-ba98-458f-99ff-d20cd2206608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818403, "uuid": "41bf9014-ad32-4a4c-95d1-bd3322087331", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c0b862-fed6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769885693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885693, "uuid": "78829844-ea81-47fd-ac4b-7c1ca9d92a7b", "comment": "Malware payload (Mirai)", "value": "a39f89c24d229f491d40db13feedfe59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885693, "uuid": "32ef9f39-64ec-4a1c-bc94-2e628bb65e6b", "comment": "Malware payload (Mirai)", "value": "3a83338f854e402c6df1a9635f026817836e18b30a6ab45f0fb58eeb6e979afb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885693, "uuid": "2aa0ce5d-bd48-4db1-b8c7-aa177e5c8961", "comment": "Malware payload (Mirai)", "value": "6dad77a19778b6da372cbc596329094dba559166", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885693, "uuid": "25c8199e-2ff7-4ed2-b9b6-79eefc18dccd", "comment": "Malware payload (Mirai)", "value": "c290d3e5016cb936939b5aeef84caf3e0086d64916883e3f512b2a136dc08014bb15d1bc1f3ea97ef770d28980fdca7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885693, "uuid": "79a6d3c2-a54a-47f8-b860-f6be8e9664d9", "value": "T12DE3F649ED41AB00D5D536FAFE4E428973534B6CE3FA7102EE245B2123CAA6F0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885693, "uuid": "7801694c-628d-49bf-a960-5adb2aae9b5d", "value": "3072:4Hwi3ahYYTKNqGyq4j4YIyAkg22QWU+aSutiqGcQxw1qjhszhRVod7OXa:Iwi3ahDKNq1qLY8kg+t+aSAiqGcQxF2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769885693, "uuid": "62b42090-7b45-4fc9-988d-47afd8b04394", "value": 145128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769885693, "uuid": "fb629ac1-7d84-424d-a558-bc180ae30711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885693, "uuid": "2fc8ac30-6afb-4fd5-818e-4b49dd68633d", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b523e7f-fef7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769899798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769899798, "uuid": "4c02caa2-bc78-4dcc-910e-0052949fe39c", "comment": "Malware payload", "value": "74fd35a0bd4142f9d9b07bf643c5a533", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769899798, "uuid": "eb556529-b7c5-4205-964c-af63af0429e0", "comment": "Malware payload", "value": "3aeebd5366b945cb86170d948413242c9aa0ae7c7e628e87b7f13bbfe6dee5f5", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769899798, "uuid": "d5c16c01-be38-49a2-9589-1a0919e153ce", "comment": "Malware payload", "value": "46309da3c5d909e12777c1ad30d9b1e79686a270", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769899798, "uuid": "9d120ae6-ca59-4f6c-8d4a-efdf19207ad4", "comment": "Malware payload", "value": "83b111a81b4fa8546bdcec618a3fa458054207c1c6a01d4d863da16ebeb7a7d948c34deb8b0a8ef5f1aa5a9be78eb3b2", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769899798, "uuid": "4a54538a-2dad-4984-8d0a-f3ecbb4830c1", "value": "T118148E1677A500FDE0B78274C9A20A42F777B81603619BDF03A05B759F272E1AD3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769899798, "uuid": "9fe4659c-e350-473c-9e99-18a28d10a72b", "value": "0b035c3c8fead7aa4469b72e1aed0c83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769899798, "uuid": "338475ca-9c45-4123-918f-b5ce89e37e61", "value": "3072:YF5zZMI+DgBswIJzY29WU8OnnflepAFeUuqTzR1Hnsyd2+sNdFjP:c5zCI+ZJx9Ua5d1/sXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769899798, "uuid": "f2401afb-cc32-49e7-9a4b-558a840c6d5b", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769899798, "uuid": "faf539a8-f17c-4936-8069-3d92390be92b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769899798, "uuid": "ef242415-cc52-4c21-974b-a61771746689", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc0e7e3-feaf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769869066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869066, "uuid": "217748e4-1743-4c73-9c37-a4d761870817", "comment": "Malware payload", "value": "8952adf21c927cd228c24ca431d3cdaf", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor:Linux/SAgnt", "colour": "#95C9DE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "SAgnt", "colour": "#A4CAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869066, "uuid": "17ce26eb-781a-40a4-849e-89d2e843bb6c", "comment": "Malware payload", "value": "3c45b91ac9d4eb5d058a16af2719b7b1acdcd2f59b177de8ce1f9fbc01e423bd", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor:Linux/SAgnt", "colour": "#95C9DE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "SAgnt", "colour": "#A4CAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869066, "uuid": "b25ea4ee-da8c-427f-9cbc-f95bd8472d29", "comment": "Malware payload", "value": "8a40971413200d4e6aeb0123811da20ac329b44a", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor:Linux/SAgnt", "colour": "#95C9DE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "SAgnt", "colour": "#A4CAA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869066, "uuid": "83c8f5e7-93c7-49a0-85b9-4da760b679e1", "comment": "Malware payload", "value": "f0c2ea6d23e2e7abc7464386453a8048ca99fe008d3f1a1ff6fb00d03f713e99391637991ef737092c9e57abfb6bda3c", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor:Linux/SAgnt", "colour": "#95C9DE", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "SAgnt", "colour": "#A4CAA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869066, "uuid": "6c2a6085-e19a-42d8-817b-b0db2f038663", "value": "T159F24A42F55150BED09AC3748B9FD237BA71B88863743B6F26C5BA302E25F61270D794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869066, "uuid": "38b9543a-dc3f-4093-8389-cb533c01c88e", "value": "384:3ECLXg+xkAvnzyUR3VsIhX45oUIfqRJpbeV6UJUM4rHbuUzmTpP8zErU+:3fL9HvneUR3VskX4k4E6UJI7VKazErU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769869066, "uuid": "b2fb20b9-a3a8-42c1-8d04-b1cce338f3d8", "value": 34344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769869066, "uuid": "bd6bff01-ee7e-4690-ba6a-aa9f70fa50b2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869066, "uuid": "e2194489-7d2a-4bb8-907f-9d177b3283df", "value": "lbdJkIHQ5p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5027687-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876836, "uuid": "16f9d5cf-5975-473d-acc8-5c7d81a26dcc", "comment": "Malware payload (Mirai)", "value": "22e94096b0b4dc8b5b120c18a2847b72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876836, "uuid": "51b04087-e78d-482a-8fd3-c392669d909e", "comment": "Malware payload (Mirai)", "value": "3cacdf6058f10e1040c1e4a72c71bfe06d5d54ebec0aa5063933d62362b3e11c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876836, "uuid": "2a89d895-09c9-487b-be39-2a2617ef2686", "comment": "Malware payload (Mirai)", "value": "4dfc15a0b5dcf31edc12c2c8d3e3262b62bc1d82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876836, "uuid": "357bed08-6497-460f-808e-16fb21f203f4", "comment": "Malware payload (Mirai)", "value": "cd1c5df80568e8fd16d7781bb7edb99e077294622b4adeec92a0536c114567ac71bc1c306440d888c198d3a208888d12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876836, "uuid": "e316e1b8-2077-4b51-ae03-53fd66dd7527", "value": "T1E86302EAFBC25AD1DEEE163E13CAAD047BD71C745C05A8E8A48001DA8556E8C5E33CC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876836, "uuid": "8cdb2405-3260-4a01-baf0-2bdd167d2330", "value": "1536:fJbgS7dL169JNwYlxAWqCl4STLkthyUpkm0Gfeio3/IZT6Le6aLC:fJbD7GfQEkfy4kJGfeio3QZT6C6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876836, "uuid": "8d33b4c5-8bee-488b-9a69-915c189bb0a5", "value": 71112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876836, "uuid": "81c8c44a-933f-44ea-bf5e-c7b69ee588e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876836, "uuid": "11710087-8490-4558-aa3a-45208ea1eacf", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da79ef5d-fece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769882483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882483, "uuid": "ec9c954d-4145-4101-83d1-f67aefcca4ca", "comment": "Malware payload (Mirai)", "value": "2b7fd65473d93b9981cfb9aa70bceb80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882483, "uuid": "bf482a73-d798-40c3-bbe0-e76b16d72b5e", "comment": "Malware payload (Mirai)", "value": "3cb3524cc14021aa4f203098a05f73b25d6b4b167b2667a595280adf109a3a15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882483, "uuid": "84ad2e2b-2e7a-4360-87a2-581bc6458846", "comment": "Malware payload (Mirai)", "value": "3d34785f20e7415d8d50d3c956c068c105154b19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882483, "uuid": "aeafed7f-be56-4aaa-bac5-de6a5c172378", "comment": "Malware payload (Mirai)", "value": "aecfa3fe8f3155802a06b073a4b402b493f46f8de8ba1c6597d17f5eca063c30651a3a77f5c1ffc4711d056c2a37152b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882483, "uuid": "8dc8634c-d651-40dd-a145-fa7f49d5fc40", "value": "T11F14851E6E329F7DF368C73447B74A31975D23D626E1DA84E1ACC1051F6028E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882483, "uuid": "4eee57e7-7d61-43f2-8dda-b825b70cbd08", "value": "3072:0bvRhrsd0RvZzHwdnetcTOZ3fY50VwHVNw4k3m7dLu:0bvRhrXJHwddYPNi0f3mhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769882483, "uuid": "53abb647-26d9-4c74-8c92-2afdbca5525f", "value": 203480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769882483, "uuid": "a4bf8230-d23d-49cc-b7d5-1edb80d092de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882483, "uuid": "7c9b67a6-e236-444f-a141-8d8d5f50a932", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c0141b-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1769861075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861075, "uuid": "cdcd8c39-3ab5-40f4-9f74-5a1ff0c632f4", "comment": "Malware payload (PureCrypter)", "value": "74d5e74dd919be1a3a378a9d8311b6cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861075, "uuid": "ee200996-70e5-42f7-930d-13a42499e93e", "comment": "Malware payload (PureCrypter)", "value": "3d6a09a7027f92acd9cd132f7550835fe17a0c58e8f161ac114cb39b0aa10e3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861075, "uuid": "b8b1a82b-79dc-42f8-86eb-77b022bd72d3", "comment": "Malware payload (PureCrypter)", "value": "884da5bbf889682bc548d8b4f8fe4dc8a286a144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861075, "uuid": "5a4f3e3b-5386-4533-8b70-674a1c7f7e70", "comment": "Malware payload (PureCrypter)", "value": "eab3e4954693126f9ac8f05e37aeaa71cbfe41c488a5ed68fd88b259d38acf76e85cda54e996eb2c2f499f292c802237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861075, "uuid": "092eef0c-d3fb-4966-9a24-48169a1e8579", "value": "T1A0842324BB4D0B62DCB4C5B7E8939268FF2941C668F3D902F81BA76D2953723C1C4796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861075, "uuid": "895829d3-bbf4-4267-9141-26285107fbda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861075, "uuid": "3daa9c10-5dde-4218-83a1-8411f04d92d0", "value": "6144:XNnfkYFXaweT5fShT5yKLa/Xjz0gNYsA7SWFO4yMrrNDSSPC43bHItx:XGYFXjecdaU8lqcMrhttzKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861075, "uuid": "9c34e9be-e044-4ac0-a646-804d387aaa66", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861075, "uuid": "26ee2db8-85f0-483c-9cd6-21debac47d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861075, "uuid": "ead8d887-3a0f-4fed-8843-7de366c7e747", "value": "74d5e74dd919be1a3a378a9d8311b6cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b1f5fe-feea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894224, "uuid": "edb667b3-a0af-49ea-8e02-395b0b49f2be", "comment": "Malware payload (Mirai)", "value": "c988c6e8f09c57a65044bcdc95aa379f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894224, "uuid": "07f9c812-7b6e-4b8f-8710-f5555fcc1f15", "comment": "Malware payload (Mirai)", "value": "3df0c473d8f1f9d49d44e03f4e8ffc2539f3742edc4d602aba548419b936f7c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894224, "uuid": "ee2acc9d-b13c-471a-81e2-68059bf9dd21", "comment": "Malware payload (Mirai)", "value": "9ec2b874d471a20181d346cef41ca1befa8e94d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894224, "uuid": "ff6a4ec9-94c2-4822-8d2d-1145487c0279", "comment": "Malware payload (Mirai)", "value": "57551529e8bf8c827332fa1c00821707272880e72547546aa5514a6ac713a9b7f88ddb7cb8ba5113beae6d451d651ebd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894224, "uuid": "bc092602-18e6-4205-9e01-51bd9031fae5", "value": "T1FE03F16D05210F5ADD4AE0F9ADC11F6219B51E908342EC83AEF6F9D71A0727E79D24C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894224, "uuid": "9804c30c-2eba-408f-a3e7-20d80fda9bca", "value": "768:5wrKt5VHF3hCtK4vay2486xMRu22bE6eiUP9XQl9FmOgVC+56JgGlzDpbuR1JU:5wQ8ByyJpMRugZZw9FmhcVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894224, "uuid": "74229e38-e2d7-4917-a40e-efd468df40d1", "value": 39915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894224, "uuid": "510ca55f-1ba6-4d3f-9ffa-cb087441ede4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894224, "uuid": "7daa8cbe-41dc-440e-bee6-5afe364aa417", "value": "ssh-agent-auth.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d440ff30-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884620, "uuid": "55592a9b-ee48-434f-bbab-b2bbacda3d7d", "comment": "Malware payload (Mirai)", "value": "c050e122bd530bc4278e0bbda2f8c494", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884620, "uuid": "60191cb1-2886-4bac-9e62-f95a0d3cd6f9", "comment": "Malware payload (Mirai)", "value": "40b1986849300313fb3725104b5ac61d11234fd87d3c9eede3303812d639e70c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884620, "uuid": "ea0141a5-37a8-4b86-aa2d-3e8895e5ee4f", "comment": "Malware payload (Mirai)", "value": "92c71d1a87223763430a40b0096dd2d2c50f094a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884620, "uuid": "588e5e9e-d7de-4566-b37f-a602ca357d31", "comment": "Malware payload (Mirai)", "value": "bcc289047559d28921474bccfeeacb6aebfd5e3495584229933d329a03e1e35a68270424dacc7f9c3e6cb04231ad66ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884620, "uuid": "8ec28af2-cf14-4bd6-a1b3-01ab67fa792e", "value": "T114436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884620, "uuid": "11a98576-4b3b-49f1-9a14-7664f2c8cc09", "value": "1536:JeESt/basV2rcZhG6ySN7naORe9xzWOIaEjrqMg:JeESt/basVTgS7naOw9BtXESX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884620, "uuid": "9c5f5fa5-50dc-4ab1-9361-8021212aede8", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884620, "uuid": "bd5d1df0-88b6-4715-941d-3fefef0d9e7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884620, "uuid": "28739f19-a78d-46a8-9ff2-1c04db37e91c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcfc0fc-fec7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769879183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769879183, "uuid": "e113284b-8e59-4c5d-b539-c88cf7085fc3", "comment": "Malware payload", "value": "afbb21cf7b8e82cace2c1968252e20f0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769879183, "uuid": "ff4ef3f8-9064-413f-b5d3-72afe573593f", "comment": "Malware payload", "value": "413dee3b7d0be24e07d586292319125ebf493bc4bd0b2ee2a75ce0c1fe2b1e6f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769879183, "uuid": "d3ce14d8-eafd-4c61-83c3-58e70bedce3f", "comment": "Malware payload", "value": "d11fe49fdbee9008f332aa4bcce0b9c23324767f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769879183, "uuid": "ab211bf7-0626-4039-9589-5c9815026b7f", "comment": "Malware payload", "value": "5b5a75bfbb28c25ca72415807e7ea06d4b46f54af646fb688871592d638b9b882d1a030306bc1a5c99f2b9563a763b1d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769879183, "uuid": "2f22f5e9-25aa-401b-9c5d-1d697060dc0c", "value": "T198848E55EBA540FDE07BD174C9B34906D772F88A47B1AA8F03D449921F276B08E3E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769879183, "uuid": "7feeca86-b808-46e5-890a-bc9d41d70815", "value": "9e99000b5e32525b916246547b73b4cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769879183, "uuid": "0f0f348a-ee15-4be3-9eba-05154cbf0138", "value": "6144:GOkkLgzfOezxYabP8OZbIdHyqwcp8dpXgfRp01:VktzfOetYaTy4j08dVgfRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769879183, "uuid": "f7bef3ae-d71b-40fa-aaa5-79c3e60b144b", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769879183, "uuid": "3948b4e9-8ae6-4288-967d-a7aa04cb338f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769879183, "uuid": "86dace47-3eba-4364-a55c-3bc141aeb0d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f2056c-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884621, "uuid": "dc48169b-d8dc-4bfb-b741-3e1b496af049", "comment": "Malware payload (Mirai)", "value": "4bdf8fd1a3010c08013a94f82aecfcea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884621, "uuid": "6f70042b-90af-4ede-8e48-bc5210db6eb6", "comment": "Malware payload (Mirai)", "value": "439d2d147a7a8cc61aa3007017bd7d3502651403a543e99f1aac20ed971605f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884621, "uuid": "548d9b48-091d-4f67-99ef-9bf7c7b65e97", "comment": "Malware payload (Mirai)", "value": "307e58ddfe0d2afddcec984138799c77afb84041", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884621, "uuid": "82189907-f714-4907-a114-d51359596b2e", "comment": "Malware payload (Mirai)", "value": "05851a3720e0f1b241b0b2d316a65429115e875c384a6fed525e2170218cc55e134b4f26dc8c6b9d81b0a8cf505600f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884621, "uuid": "14290a14-bce7-4baf-89cc-6fd4f21c087f", "value": "T19E330952B88145A9C6D047BA771E978A336363A9D2DF7353DD0C0F4066C970F4EABD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884621, "uuid": "d37f59f4-b4d8-4a05-9e32-ff6301a32195", "value": "768:/JYMay9aQ8tD/TVWPysgDUjDroGhNzjdXM4v2Fr0nSz:/JYMv9qvUVXjPPhNzdRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884621, "uuid": "c12b04bb-3582-4ba1-a347-dae82bd59bca", "value": 53672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884621, "uuid": "64720a23-7ecd-4739-bb83-33324639ef92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884621, "uuid": "6e482b6e-6559-40b0-a0ce-f41b741091e5", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3362fc-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876872, "uuid": "decea2fa-8e3a-4ae3-942e-02c81e640443", "comment": "Malware payload (Mirai)", "value": "278e042cd2e81dd4db55d64b27fb06c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876872, "uuid": "f7bd22cc-c325-458e-8c1b-f280dbf83f18", "comment": "Malware payload (Mirai)", "value": "4476d2d976642fad71e655a36ae01fecbefad6966f63ec2688f9e4e162d02a7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876872, "uuid": "7e86fda4-da10-4632-b232-4d447720cc3f", "comment": "Malware payload (Mirai)", "value": "bb5de31e3e4e0189f88e83d313645393af9851e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876872, "uuid": "2c2eba6f-e59c-4792-abc4-2dd5dbc8c198", "comment": "Malware payload (Mirai)", "value": "31a39f555e850f95def44bdd3b33d124a72ce1712edd0fa9585eed3850cdd243c791c9074715ff0e10d19413bb3ee51e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876872, "uuid": "0c6539b6-5749-47ad-a363-bcc5af5aa79f", "value": "T1C324E70A7F510FBBCCABDD7702EA1B0128CC681B25A53B757674E914F54A68B0AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876872, "uuid": "870e40a2-5697-404f-9e5d-7439ecadbce0", "value": "3072:cXTNAD2nCtAJEPiSej5qqANCXHzYoTuAK6hh1PtjIu:cXTNAD8CtAiPsTANSUoaABtjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876872, "uuid": "39067542-6d08-4d52-870b-02ae11f6872f", "value": 210728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876872, "uuid": "a2cd96c8-e544-40be-84fb-97b22a8649d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876872, "uuid": "e41324ff-8c52-4d8d-9ce9-4467f9053a5b", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0cf76d-fea8-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769866163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866163, "uuid": "bf835932-4df2-4318-8ed7-efce9130df80", "comment": "Malware payload (SalatStealer)", "value": "dbfeea0b6ec18dd542e41ea1da439c8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866163, "uuid": "3cd53789-746d-466f-96c1-61a69fce21c0", "comment": "Malware payload (SalatStealer)", "value": "466eaaa3dfa085451b1ddf7455914d2235ffefb763f85afaa630fa7c6d309578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866163, "uuid": "bf7d0c28-d22c-423c-929a-657db1f833f1", "comment": "Malware payload (SalatStealer)", "value": "fc92ec4a9c0ac504b56994d1aaaa9f2c10d7f124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866163, "uuid": "d33cb963-bde1-4234-9941-dfe803b60af3", "comment": "Malware payload (SalatStealer)", "value": "27319ba3d2dc8a4f9e56bb9828ba8b119827bb457bc2f009d4636ac95652e266abc868ef279471046e615821f7dc9538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866163, "uuid": "38cb847b-d202-41f2-90b6-a8b5b7f80154", "value": "T18CE533F04906D76FF3410E79AF324AC7618A9D034F5416E2532961A36E1335FABAB2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866163, "uuid": "78892155-cf9e-4183-9d4f-e7f5867969e8", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866163, "uuid": "ff7f5878-e397-4f70-9314-88b73f9f8d96", "value": "49152:dkKwLF8zKPBQbJqi3QYY5uhSOUvwA9rS9IV74jz/uMsZ4EzDZ82rR9CivduBtiwx:dkKwvBQOYOOUvlr8zLs3FXjCQdwNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769866163, "uuid": "d9f16ade-43f8-41ac-a667-f376e350a908", "value": 3245056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769866163, "uuid": "5d88e852-cbd7-4483-a586-0cb3b04e7c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866163, "uuid": "835993de-0bac-4392-b2e4-caac09ee7366", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.16447.12491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f432bd-fe9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769860062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860062, "uuid": "c1101d67-812e-4bbb-8565-ccf2f35a2d20", "comment": "Malware payload (Mirai)", "value": "cd22351bab103b013c088f00e37503bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860062, "uuid": "f6665bac-5c12-4360-a215-6a1d61da1ccb", "comment": "Malware payload (Mirai)", "value": "46e241c461922b6909115e8f887a0ee4816b83a6a4205f2e258da4622eaecde2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860062, "uuid": "79eceb49-65f0-41bb-8765-3699ca208ffa", "comment": "Malware payload (Mirai)", "value": "22ccb0dfcdd697529a56898db5d48103589724c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860062, "uuid": "bc678fcf-3e39-438b-8013-e26174d33190", "comment": "Malware payload (Mirai)", "value": "d6d69b4bd0360dffbb84d77e1c4ef577625713887ff4db55846efa2515083c62511f896c62824c783bcddb916d00497b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769860062, "uuid": "88837ce3-324c-4125-bb15-52761991b012", "value": "T11463B81E3E318FBDFBAC863457B75A259358239A37E1C5C5D26CE6012E7024E241FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769860062, "uuid": "1416030f-1f73-4dee-b66d-5d7f8fc44f4e", "value": "768:Dq7kbHlAvs6zIi+z7pcKHt006+X4AtHo8ucyNG8uwA+UHJUQBnlaiXJHmwh:e7kx4s6ELZHt9X4YlwA+UHDzHmwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769860062, "uuid": "04b1e9f1-5a9d-433f-b755-8e05feb43573", "value": 67988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769860062, "uuid": "b785cf0c-b7c9-4b91-b9ba-08a9b0e880f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769860062, "uuid": "c31dd6c8-ed85-4e53-9f99-02d00b6f5d45", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21cc33c-fee9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894092, "uuid": "5db619e4-e8a9-4502-8bc1-26ae63924607", "comment": "Malware payload (Mirai)", "value": "21194f15bb5ce1e06cfe307bcf2cc109", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894092, "uuid": "3596cdc9-5ed4-43e1-9784-b4c6883ccb0b", "comment": "Malware payload (Mirai)", "value": "4764c496d2e6fd15973f5548e02911b916841621ba947fc3995bb7baa9bb0cb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894092, "uuid": "e736b483-6c5e-4173-9df4-1d6e4b3de410", "comment": "Malware payload (Mirai)", "value": "39d73d15397eb27ae66885b654417b2826ea0be9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894092, "uuid": "79ca9e64-a13d-4e29-9661-4488a8bb818b", "comment": "Malware payload (Mirai)", "value": "6824195b9c60ad2a5fc9042c0f46eea791e80d192f7d167a898d884b9c100dc99938dba441e86353a180b3ae7e4ce098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894092, "uuid": "08c7b2b9-feb4-45ea-b6a2-6a5ab8bac0bb", "value": "T17C53022391E1D6A04E2B58BFDBC10293E5114BFC1B9FAE6F43BD41E7467398522B6407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894092, "uuid": "b98a896c-41b1-4860-80fa-b7b0432eb33f", "value": "1536:IVXHTDtDKDk+bQl5EyCE3jkPeDBoq3L52PM9rkPTk1m8:IVHL+M3Eyxhoq3L5RZ1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894092, "uuid": "afc073fb-9b3e-4775-8047-637b18fff892", "value": 64187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894092, "uuid": "1ee3432e-45f4-4e1c-b443-6a7ad09d32ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894092, "uuid": "1eefc079-c7d3-407e-82db-79c90f7e5074", "value": "ssh-agent-auth.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279cf841-fe85-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850829, "uuid": "a3a7d2aa-e82a-402c-8d40-d0c20c3abdfe", "comment": "Malware payload (XillenStealer)", "value": "25daa47bdd6e95d0820a36b2d88670e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850829, "uuid": "2c30c0ea-7232-433f-b21d-c6efcd65fb8f", "comment": "Malware payload (XillenStealer)", "value": "479acf6c5367318dd4c1285cd7c910d54e16372f92caacbe9bbbb72321dd7389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850829, "uuid": "a0859cb6-9884-411c-98d2-14352945f076", "comment": "Malware payload (XillenStealer)", "value": "f9330b793b52129e88f9d7ef6f7be4080c8c152e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850829, "uuid": "8c9c18b3-a0a5-4ebc-ab13-9dda90f4a348", "comment": "Malware payload (XillenStealer)", "value": "7c5abc346f0a6cfd0d88e28a20f601fa4444fe921214fd81563340ba8feb15e41bc2da397bf7e114803fc6d6ebf5b96f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850829, "uuid": "bd191559-8da3-4015-b763-6e3adafe9e42", "value": "T1A1853313AEC126BDFEB4EEB0553B2F997DC6B5B454790A8C006477646C13AAC3588C8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850829, "uuid": "e9be1ee0-857f-4baf-a738-979664e397db", "value": "e0a2c0168120df22501a39283b15736a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850829, "uuid": "cbb7a30e-acdf-407d-aeef-1046e58372a2", "value": "24576:UZCXLwYXW4MetTlacFaO7QXjVY7frgeC8Bf0S3CBhf0a3p3+FqVb7m:ACXLmiuHGfrJvmbB0ApuFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850829, "uuid": "6e317d5c-6cc3-4c71-945e-feebd615a2b3", "value": 1779448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850829, "uuid": "8bfe7ede-c4ce-4091-9b15-3cc1ca5d5c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850829, "uuid": "435effc2-b480-4bde-adea-a3e81f0a1757", "value": "25daa47bdd6e95d0820a36b2d88670e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733a4b93-fe3d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769820032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820032, "uuid": "655ff4de-5f01-4bd1-a1c8-f159ab7d8b0a", "comment": "Malware payload (Mirai)", "value": "0ecd7442df44c36c05f35512362ce129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820032, "uuid": "136e6581-10a9-415a-abaf-f4f0e7410a49", "comment": "Malware payload (Mirai)", "value": "48462f052171cbf7860ff9c33cbcea26a7242300ea24c80d638ae0c15b817f28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820032, "uuid": "9eede9a6-fb3d-499d-a230-0b2d26cbd321", "comment": "Malware payload (Mirai)", "value": "bc558064f96d5bb94f3ded5a71830261680e1bb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820032, "uuid": "14cd5b96-ff75-44bb-88b2-10c3f56eafdd", "comment": "Malware payload (Mirai)", "value": "182eb7727fb68371a5f706fe5918fdaeda95a5d5e76ae5ec096280e4348017ccbc878895b5db487bd92bc1796ed783c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820032, "uuid": "9d70d914-10fd-466c-9371-f02dcd7037e4", "value": "T119B33B46EB818B13C4D51779BAAF42453323E714A3DB730689186FB43F86B9F4E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820032, "uuid": "a8e44fe5-0c53-43db-9a5e-1ce5a6d59fe2", "value": "1536:F9ndOeNJSAdvw8H/A6BGOeKdfGcbRUNpC9l6KiaUKndepRmK655Wzw/9w1iKOdRx:A+JftwW9zfGcbRU5OUKdEm35wM/9/KOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769820032, "uuid": "7cd6d46d-ec9b-41fc-8576-38d2d42b15ef", "value": 114560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769820032, "uuid": "4fbe6e3e-9339-4264-956c-f320fb9112e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820032, "uuid": "57643585-9bf2-47fa-813e-6a7032f75c98", "value": "0uparm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85adff72-fe92-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769856570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856570, "uuid": "826ecd06-86e0-4b86-aa3c-891ec82fbf0f", "comment": "Malware payload (ValleyRAT)", "value": "3db46e81663e87cbd787feab5fa06800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ValleyRat.YAG!MTB", "colour": "#9CF83E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856570, "uuid": "b59db445-7db9-4403-87d8-987e33b7f9b0", "comment": "Malware payload (ValleyRAT)", "value": "4977999a446adb8831780c2f3aaa46dad084da7969e494ce34085a0832bed2a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ValleyRat.YAG!MTB", "colour": "#9CF83E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856570, "uuid": "bdea473e-b95b-4857-a4b2-46dcd38ce6af", "comment": "Malware payload (ValleyRAT)", "value": "202a62c28bc091217d3fa3aac3cb7ad49aae61ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ValleyRat.YAG!MTB", "colour": "#9CF83E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856570, "uuid": "a8ecb0cd-e11f-47c8-b919-1ca1f06875ee", "comment": "Malware payload (ValleyRAT)", "value": "3cec3c3a5a73697d01829f0fd1a9263f93cdf73a47a1dea20b4b73b6123439694c24254dbdb6d9f636599653ba7164ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/ValleyRat.YAG!MTB", "colour": "#9CF83E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856570, "uuid": "f84e948b-20e6-4791-b98e-9c19f8116b4a", "value": "T1C6723B89FBA60DE9C578967DC977552654F1B623432253CF1360862E0E3F3C2AA3E781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856570, "uuid": "eaaf7403-df51-4329-a147-24545606c569", "value": "15028d73ad06515ff9300721e94cc549", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856570, "uuid": "189efcb4-b279-411f-b4de-dfbd70b441fe", "value": "384:k6kYVSuhPLRd5ZxmOSYbb4Ad3YbE173V4u:nIAR3KAJXt3uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769856570, "uuid": "69a43093-4ad3-4c6d-a3ea-fa38475f8301", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769856570, "uuid": "14a09b55-3e15-4859-bc1d-80a934b8315e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856570, "uuid": "0ec07ae8-31b4-4c8c-8a40-ead427366cf4", "value": "inscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92374c0-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876843, "uuid": "34dbd2d1-867d-4700-b941-86a2abd57639", "comment": "Malware payload (Mirai)", "value": "6e0010307ad9d859dee263081185fefb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876843, "uuid": "032e55dc-b41e-4fbc-86ed-7a3fa3c3a94f", "comment": "Malware payload (Mirai)", "value": "49980dbb7cd975261b6e19b49fd2f6c6f780e7831624ec5e8b728a14ab928336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876843, "uuid": "eaa68ba9-dd42-4931-a5d9-a3d4c3cd6690", "comment": "Malware payload (Mirai)", "value": "2c8fe615b2a87181aa2dfeb66effc3c0030ae1f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876843, "uuid": "8a8c9408-ca88-4097-9435-61a357554fa7", "comment": "Malware payload (Mirai)", "value": "bea89fcebe41c51b98d557dfc2465527cbe11090c0b0d8709af030bcc3144e7f400dc26e40dd018aad629130df129bc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876843, "uuid": "b0ea4415-bd5c-4b2a-b12f-e6f4063c9fda", "value": "T1E88312FA7DB28DC5D62B6C32078A4DDCA05D125EAEEF52067C30A42EF134194C5958EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876843, "uuid": "1dea8051-2728-4bb2-b930-08503195ccd9", "value": "1536:/1VUEh7H5fM6FPTQgUMz+016C+Wht8tO6eJBsbC0mUD5zj3ID4wdag25FgYhR3ZN:EEjfNPEgUMz35gOXzveBj3S4w8gKZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876843, "uuid": "d16cc693-ade5-462a-806c-4b9fda733149", "value": 84004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876843, "uuid": "ab89c39d-9081-4e96-a41a-c4cc760d956d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876843, "uuid": "81d10d0d-1404-4746-bbfe-a4fd9cfd8dcf", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d609d617-fe71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769842532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842532, "uuid": "3f19d513-1585-434d-b012-a1cb48b74fca", "comment": "Malware payload", "value": "2c4a2cfb45669d009cf0821e3f7bc74c", "object_relation": "md5", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842532, "uuid": "59af96db-7239-406a-9c18-d108650306b4", "comment": "Malware payload", "value": "4998897200cbbff6df24a401733d1839cc461ec8b5455f3a860ce4df3ba6e4fe", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842532, "uuid": "96d771e4-17bc-4909-b1a5-f16644dd59d8", "comment": "Malware payload", "value": "1399e5e3168936952bc4566b33cc17308e492cb7", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842532, "uuid": "a477b3b7-d97b-41de-9e8e-f3b681533ad3", "comment": "Malware payload", "value": "a538f8b4d7b62f1bd16977e9bf95578188fb9463f784104db728159a8f2641b9ac35bcb30c6b06cf6576e79bd05f15d6", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842532, "uuid": "a1f7ffce-d8a7-46de-b105-ce819872fd52", "value": "T181959D15E3A801A4D877DB34CA669333E67078965730E18F0698D6492F73EE19BBF312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842532, "uuid": "86500509-13e6-47f7-82a2-dd36f7289228", "value": "93e506162c6897cad7ca44f2a4bef14c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842532, "uuid": "af428749-6229-4546-98a9-a762bc03ef36", "value": "49152:btA5hAdNfBozFVZ4UAimxXjLelbZSEimYG1ZzqF:cTYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769842532, "uuid": "78fd8ee6-c7c0-4d8c-8afc-9074427649fb", "value": 1885696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769842532, "uuid": "51375226-119a-46d3-a8ce-88919fcabc47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842532, "uuid": "ce930285-b8b3-4927-ba20-92f9604e991f", "value": "mpclient_core.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfb7c6d-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846625, "uuid": "87c6aade-4197-4d6e-a9c2-d584f66b9042", "comment": "Malware payload", "value": "6d3a1ceacb1a62e9b7fe1415c7fa041c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846625, "uuid": "3e0ecdc7-9d0e-412c-a169-39875d4cab1a", "comment": "Malware payload", "value": "4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846625, "uuid": "cda56e6c-6304-4209-b014-18ad16f12677", "comment": "Malware payload", "value": "84f5285426ceb14b5948f7902e7689938ed7f245", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846625, "uuid": "0b443a32-924c-4a09-a6ba-684b83ee5973", "comment": "Malware payload", "value": "d590c98271ac07a37adf58a9922bb0845ecbf874f3189e41d497455d6f58581011b23e383032cf03dd22957a9d8f143c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846625, "uuid": "1a2c9d82-ba76-4d66-b7d4-c446972e7fa5", "value": "T122F36C17B3A500BBE4739239C9A30A42E772781657619BEF03A047756F673E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846625, "uuid": "8fdd386c-78aa-4759-9617-e5623aeeaff1", "value": "f9f0e87ecf133996a285a6a9b5271211", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846625, "uuid": "142af394-bc4c-43bd-b825-bb10cba97e1c", "value": "3072:QtdC4rFcFbux44OALpJmI03bOskb4pzJ6UaSkgzCk3WsxlU5UkyCj:QtdDpJmIgJFIIkgzcUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846625, "uuid": "fb873891-fd3d-4fa7-9bde-255ada2c92d6", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846625, "uuid": "28157e29-d7f6-48ef-ad55-c42d6957e377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846625, "uuid": "9e818bef-7b39-4762-89f2-ac909cf5fd38", "value": "4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d55d08-fea4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769864134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864134, "uuid": "e6bc6513-d0b8-4be1-942b-85cc9a1b8e22", "comment": "Malware payload (Mirai)", "value": "39661dfc9437807b448b871c0aaf6511", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864134, "uuid": "c010fcd7-4bd4-429e-b96e-d0068a22465c", "comment": "Malware payload (Mirai)", "value": "4c05e52c7ab0f90efc6fb4a57d7703fdadf6a8fa0fa021870826f8f86a51a394", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864134, "uuid": "13df9818-c383-457f-a6cc-b30b95a0fa4b", "comment": "Malware payload (Mirai)", "value": "20c38aafe7867f8d55ea62eec8977382c98b9c13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864134, "uuid": "2683f0f1-220a-4b14-9bec-99e78d2b1492", "comment": "Malware payload (Mirai)", "value": "604c0770ff6418d7c76e6b3924530fdeef2413c77baa3bc698c13c0b174317514375fb24e77be08c4ed5a01e03975a63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864134, "uuid": "38530673-4a11-4722-8858-aeb4429d3f0b", "value": "T195F47D63BB218FA4E325D67005F38A115BA522E20AF395C5937CD6107A50B6E2C1FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864134, "uuid": "1a0d63aa-f51d-472d-acc7-dc4ba93269ec", "value": "12288:YWj7oP6fuyfFI4V9st6BhSiddGgpu3i04qQ:YWAiT2bIBhSy4f4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769864134, "uuid": "0f6aa5cd-6a13-4b9f-be94-4cf217ee4719", "value": 730632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769864134, "uuid": "10c97554-b43e-4bfc-9b94-1ccd334894b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864134, "uuid": "04fc916d-bfda-47c0-ae6f-d6287d6f312e", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642a6043-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846636, "uuid": "3f343cd7-ac05-456f-a0c6-ca378f0c2fb9", "comment": "Malware payload", "value": "d46951763acfdd0eec0e464309864a4d", "object_relation": "md5", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846636, "uuid": "ffb81709-824d-457d-ab90-94b6df614697", "comment": "Malware payload", "value": "4cfa51131a22c820002eee18cb9f52ad189337db320a5790045c463d6d88a446", "object_relation": "sha256", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846636, "uuid": "0fe1e429-2b85-4dc0-90ba-d5805c72c322", "comment": "Malware payload", "value": "be0379c5cc738f1ade1898bdc9090ebea7a74644", "object_relation": "sha1", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846636, "uuid": "45b79364-ea0d-4eaf-b460-b962a8f2bd5b", "comment": "Malware payload", "value": "70a00d6f2734a41412a2eca184593febe5129dafc6ee9d70ed3dd299297f1491cee03e5734d108a236e8bce69a1c2b39", "object_relation": "sha3-384", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846636, "uuid": "c6249152-c017-4a2a-914a-fcde66f65621", "value": "T1C6814296AC06D594297663328E7FFC4CD8A206BB0507CB48358EB5D22F743218F6DEE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846636, "uuid": "a4b07bfa-8f03-4d0b-ae1c-8854f06c2099", "value": "48:chSDiD8oNS4Gvd7RpJFtDFeIzTbUdP0rHytszSZmucEBZ5vZucEh1/YPxpC46:QSzoMvFXbMP0rHk8ucANucW1gPt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846636, "uuid": "81f086b3-6eb7-4eda-83b0-03d57c62d40f", "value": 4069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846636, "uuid": "7f0c42d9-b91c-4f9c-a0b4-ea934297c1f3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846636, "uuid": "e3b93eac-f6b2-4fe9-9524-85a94167025a", "value": "4cfa51131a22c820002eee18cb9f52ad189337db320a5790045c463d6d88a446.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9451c12-fea8-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769866187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866187, "uuid": "846fcbfa-c1ae-4477-a759-57ddc3c72535", "comment": "Malware payload (SalatStealer)", "value": "67e40f1bc0ce227d400f9ccb10d78def", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866187, "uuid": "04c4a741-942f-4876-ad5e-5f8e9b55cf00", "comment": "Malware payload (SalatStealer)", "value": "4ec6916ca3d4f328e21a32cdbaea12c713abeb472544e24226b3260c784775cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866187, "uuid": "11fb545c-5c6d-4b3c-aa9c-64e3b6b39993", "comment": "Malware payload (SalatStealer)", "value": "3a50d9cb563e42dd26f202bb88f64d42f093d735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866187, "uuid": "2e3f1759-7464-4487-a632-d1a8b14478c6", "comment": "Malware payload (SalatStealer)", "value": "cbf6330118d268ac227b9bb78b4025cd600f2023b4ed0dc8fb2c4eb2b7340af93c74190a7fb86442885ef22051d2ae45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866187, "uuid": "620db56b-ae36-4787-8a88-ca6b2699e5e7", "value": "T124B66C41FACB99F5E9032831416BB27F63345D048B28DBDBEB547E6BF8776811C26209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866187, "uuid": "34491973-22bc-4710-98be-48d5260c4a5f", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866187, "uuid": "b75f9706-c658-477c-a6f5-4c59df907ded", "value": "98304:5lebkWUSeJ8TEnTTmOiPIggtAPBmPRD6faRk:nJ8SHiQjRhRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769866187, "uuid": "ffa84dd8-a589-4008-9c87-4e22b2c7928d", "value": 11402240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769866187, "uuid": "e330a34f-097a-4b55-8c35-f87ab428429e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866187, "uuid": "2190c647-a710-4b74-bee0-bd41a9ea3850", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.28485.23761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ed29b0-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769861247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861247, "uuid": "703243d7-1e79-49c1-bdb0-8a50d6fe94eb", "comment": "Malware payload (Vidar)", "value": "eb6626a87c86e55ead5ce1dc2db24581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861247, "uuid": "e8573361-ea23-445a-b060-4d1b19c8c46f", "comment": "Malware payload (Vidar)", "value": "4ed8567ea2048af98c1a36219e521df92a9fbba4e1229a3a7d850bd5b6682bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861247, "uuid": "b2626f5f-87e2-4922-8f20-32d4f3562007", "comment": "Malware payload (Vidar)", "value": "f7b3b5e7677ee6aad54e882de91e8f958a1d10d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861247, "uuid": "4605da2a-61d3-4072-90c1-4f8253111f0c", "comment": "Malware payload (Vidar)", "value": "48c7ef61346692077aec9eede5c1734e77057ee0b2497aa738cfc25fa29c2e89a1ae2cdd3884db74740361fbfe46e350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861247, "uuid": "a551cd5d-d65c-42a1-a581-c45ba2b6872f", "value": "T1B10423C28A2CFD3FD23CE772170121204797B8A187DBCB16BED2D2910A974796ED74A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861247, "uuid": "77ec8c22-693b-4d01-84a7-854499322051", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861247, "uuid": "81a238fe-1c3d-48a7-b1ee-77d8b981e925", "value": "3072:MhDwMWe7BmNeIwCNigK9PjeyfA6nF6C1UTEQam98qLG6TAUbyV/zu0rXeHP:Mh0MTmLrigKVjeezQkVQamOqC6HbB5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861247, "uuid": "f91ef42e-c772-4fdc-b462-11f6bba38a26", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861247, "uuid": "bdc638b4-c6d5-40c4-b784-bbd395fac3fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861247, "uuid": "a4413a78-8619-4b03-b87c-9d710176a683", "value": "Wfo8KJM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e4330d-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855604, "uuid": "b41c744c-550b-44fd-8e52-18233154c1db", "comment": "Malware payload (Mirai)", "value": "5412a93a6b83bcd3f0e64b6263d09edd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855604, "uuid": "500ce465-63fd-4b6b-b4e0-02f2ce2cf5a7", "comment": "Malware payload (Mirai)", "value": "50638fdf01e19fccc5f97e42c09cce90885f1c59c8f6ff0a89ba81db794eb1ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855604, "uuid": "9e47716c-2d9d-4f0c-b42b-b3eeff93e87c", "comment": "Malware payload (Mirai)", "value": "420f6b29ace1e7e3f757049115f72c8d3ac6e830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855604, "uuid": "1fe33905-81d3-46ec-9196-dca072bdc657", "comment": "Malware payload (Mirai)", "value": "28fddd2e14ffa747049adb4d1297db120ccc03e87e46e98813dacda3345dfd86d08b175e91187e728c7d2cc197b98aca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855604, "uuid": "11bca6af-3618-41f1-a85a-cf37230512b3", "value": "T19BC39E32D8396DC4C1945434F8B1EE711FA2A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855604, "uuid": "bacc8456-6865-4918-b420-019c613289f3", "value": "1536:iaZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKQk0kaXN7Y+UKigHcYSQwKprlzwwn:if5Z5Z98XdmVMJa5aX7biySQHrMwEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855604, "uuid": "b5c0bb6e-e436-4efb-b6de-31b17f6e3b03", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855604, "uuid": "a7544a2f-1be8-4321-9acb-9cfef52c1452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855604, "uuid": "c200cc3e-9dc8-4b48-9bb9-4464fe737ed8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d096cd75-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884613, "uuid": "8433b228-874b-47f2-bffc-c35ce769b426", "comment": "Malware payload (Mirai)", "value": "1f739a234cb164c977b850c1da1ebc16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884613, "uuid": "7fce4706-5d16-4c24-88a3-5705206dfabc", "comment": "Malware payload (Mirai)", "value": "5163a1507e5eb388355584bb5883565c394adda446ec8bd5788fe215f89acea1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884613, "uuid": "09d46f77-1e2f-4d2a-bc96-0aa782b4bbd3", "comment": "Malware payload (Mirai)", "value": "17951451a4a2b1fcde1307e7bf0fc27a55425e22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884613, "uuid": "b71e7ad6-9091-490c-b7c1-3e5e929e43d3", "comment": "Malware payload (Mirai)", "value": "2c9b0637d5125c7bf8a3993d9dbdf73cf22da1133bb4394a88887bc62ab62f4e50820a6f8fd60842aa604612bd645e79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884613, "uuid": "30c23ab4-902c-4433-be4d-904e90db84aa", "value": "T1CD83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884613, "uuid": "573f269e-4ad4-4716-9464-778ee54fd3d5", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTA7ZDYovZ73x/nL8y8Qh:Rakdn2Eo3ePu5GTARYo99Be037W+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884613, "uuid": "5462b7ef-c27b-4207-b1ef-02a0029138c1", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884613, "uuid": "3ddd72eb-e815-4a47-98e5-90e57040b2ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884613, "uuid": "d1705f07-1149-4f33-aca4-ae816aafdf71", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9300d3b4-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877209, "uuid": "5b8f8959-f7db-4050-bd1a-0a154b73e8b0", "comment": "Malware payload (Mirai)", "value": "d4f533301dfab5668c70ba350f21f41c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877209, "uuid": "641b3331-5f28-4869-87db-897cc9d68299", "comment": "Malware payload (Mirai)", "value": "51663e747e9c00087a93fa1b39bcc4b3b2dc81a278f70aeb2fb36c15740a29bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877209, "uuid": "9c9faac9-1f04-4a8a-9465-e9e852654030", "comment": "Malware payload (Mirai)", "value": "06879468dba3f6bf5b802f0a1eafcb3282bb7aa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877209, "uuid": "35a1cb74-1fbf-4477-8481-107d3ed39869", "comment": "Malware payload (Mirai)", "value": "6f6b39afc17a2c46dc08c1527b862928112c4b41309c1c1e8201ead885d99b76b4f35735da5ba1b38d1ed85023710910", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877209, "uuid": "820f6bf3-4ea6-44a3-ab41-84d84dca9114", "value": "T196A3A388F964A37EC7E1B7FBE75807CE333A0A98A7CB7721993406146BC97547935220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877209, "uuid": "e95d18d0-e8e5-4361-a944-7b863221a91d", "value": "1536:aupuszoeo1CRfPaqt7KeB/zRUeU99zDccAYZ4gc+wV4PRWCW:aupuszSeU99zD1HxbPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877209, "uuid": "941b9fc7-680e-4398-a791-a0b017d63dbd", "value": 99817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877209, "uuid": "66df9370-fe40-4a4f-8eba-496518338d2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877209, "uuid": "86450448-a10c-4bf6-bfed-05de7ea41d59", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3009b2ef-feea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894223, "uuid": "1dfed0e6-d892-4685-9c31-cfafe7da70a1", "comment": "Malware payload (Mirai)", "value": "bf70ab14da8e18d90d7b8bc258740e86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894223, "uuid": "661a7a6e-4cd3-4ca6-b209-c67c5b14b1e4", "comment": "Malware payload (Mirai)", "value": "523e36ffff2bf201b288d2a55d0be47a86e3babc481c97bc05c9af3063d34c08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894223, "uuid": "b3b221ac-2f34-43b2-a2ca-a514e32044b2", "comment": "Malware payload (Mirai)", "value": "8b35597b8bc4f1c91ab21003f4de9bcd08493335", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894223, "uuid": "ab757f61-dd85-4398-aa90-90f55c8ce1ed", "comment": "Malware payload (Mirai)", "value": "16166657f92d35e972ef7ee4b666d9b0ae9f27c120e4af5fd91d1abc9f1e12599f499d695ae0d37f2df8f23ec23b2c17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894223, "uuid": "c110f667-d022-490f-a043-febacdfef2be", "value": "T117933A22B976192BC4D4A97762F30725F2F6838A20EC8A1F7D710E8DBF6464036537B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894223, "uuid": "e9ecd0d4-fd5b-457c-a55d-2c285530dbc3", "value": "1536:NjtESYAKljE1QfoXO8pOBM3e6tsI/CCRUU3+aFM4PuXHw2lptyUWx5UtKuico95n:NJ/+lNqq8fcoPW20K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894223, "uuid": "6b32f6a5-b5ba-42fe-a88c-ff16d9646b91", "value": 88899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894223, "uuid": "fecfb808-0091-479f-8ca3-d48bfc9b71eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894223, "uuid": "a7aeb295-809d-4a3b-b95d-e97a75abd83e", "value": "ssh-agent-auth.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825d59d0-feef-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1769896508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896508, "uuid": "3ea74763-3e9e-4432-9e5c-61d866184c25", "comment": "Malware payload (DCRat)", "value": "9d18ee23e1c0f2575d1638502d753aec", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896508, "uuid": "5d5d2cb8-ef59-4bf7-8db7-4be5d051f69a", "comment": "Malware payload (DCRat)", "value": "54193af95cf82cdbcc2b331bfd7112915a54bfd872b4fce2e148777fff41a995", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896508, "uuid": "21c09f1c-4c45-4a12-8575-2e80f91f011d", "comment": "Malware payload (DCRat)", "value": "af221e6609bb544787a5baca96f1a7faa620ef5e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896508, "uuid": "ac24287b-73b4-4ffd-a941-a01941073a4d", "comment": "Malware payload (DCRat)", "value": "f577b1198790e51d836c402d268c7bc5ff34ec9423497e9bafcfe80711b5d52166d092cdb1aa78ae763d411b92fc14c2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896508, "uuid": "da9ea0ba-3b4d-450e-b5d1-d7ea2441cad9", "value": "T15D05D72429EB003AF177EFB459D1399E96AEF6F3B7079E8E305042C64712780DD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896508, "uuid": "74b3087b-c510-43c5-bfd9-3f5cc074a65b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896508, "uuid": "c16b194d-9046-4ca9-ad4a-5bd589b46f0e", "value": "12288:Flz1dGWP2h6tKAAhiIniuwKI5wzuuGhP/Sknk7HtDHEre/OfGVapM61+:FlFvtzAhiI619qN4rpM61+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769896508, "uuid": "112b12eb-5431-4d6f-8cdb-eb6d0a38c666", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769896508, "uuid": "9906fe64-7f38-4a44-8b85-a9237f89412b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896508, "uuid": "78c3aa0a-2a49-4c3f-8be8-341b2125b54c", "value": "nyashka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8f15fe-feea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894220, "uuid": "34ccaa94-37ce-450c-a62e-815f3dd67364", "comment": "Malware payload (Mirai)", "value": "65d5784d16d03b99864f3e14f8d288af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894220, "uuid": "b048a0f1-ff42-4ac7-abf9-9dac714e507c", "comment": "Malware payload (Mirai)", "value": "545f3cee26f42cfb09ce2ccb6d70fc6fbebecb42eb11fd2f72172dbbd6581883", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894220, "uuid": "10ee69f7-3700-4851-b9de-5445cbb83650", "comment": "Malware payload (Mirai)", "value": "a5bf08fc07ba1268f7e7f82a94ab7c2293e5f20d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894220, "uuid": "763ef09b-e1e9-49f6-ae23-345d5d6f617f", "comment": "Malware payload (Mirai)", "value": "e3ff1956c676a31c515901ba36c85783c5e2658dcc58fc28e665a70250d4d6eb2ae62fe38f772e9914de0ff45080dbd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894220, "uuid": "f6f5845c-872b-4016-a96f-968fc3fcfdbb", "value": "T12603F16CB52429C1CA5C187D91471B519A9CA3A0139BDBCE8F1288CCF569DCAFD0E8ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894220, "uuid": "b07fecf7-7ff7-4ade-a4ee-2b929ce0be7e", "value": "768:kSKetqQX5Cv/fyPgEIWasjHyXcMzwN0BOWM+/MigWS:kStqQMKP+MwEi0Wd/Vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894220, "uuid": "9d768858-2f7a-45f1-b757-f29cb7169ce9", "value": 40903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894220, "uuid": "99c598ee-5ebd-4346-b874-1b4d354d9bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894220, "uuid": "59638b46-86ff-44e6-98cc-9d9f74dd6482", "value": "ssh-agent-auth.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56a557d-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877669, "uuid": "9d47f8ec-9bb2-462b-8d7e-7a695ed046bf", "comment": "Malware payload (Mirai)", "value": "2dd1a8801f821d86bd3d9f184ab9943f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877669, "uuid": "60e8e118-2d08-4b6e-9094-d3943d37e48e", "comment": "Malware payload (Mirai)", "value": "54a8965b645fd70a21c5883c49d4da0e33bbabf8ed08f73ad8f8d70d5c4cab3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877669, "uuid": "16c71913-ab8b-4ff6-9a10-8d09da821d6e", "comment": "Malware payload (Mirai)", "value": "2ad7e2af16632881f3d3c1e9e6f2a2845b1522e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877669, "uuid": "38e63b74-8292-43b6-84d3-2c4c8e133bd4", "comment": "Malware payload (Mirai)", "value": "6916cad85febbfca2bae1ad2f6af8b3b5fa59a0a6443d965c68053c5b8b494fb68dc29702dc1d44c84276051e0e76d7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877669, "uuid": "a619a989-c4e4-447d-b870-2774370a9ade", "value": "T1E7730A46FC818D11D9C91379BA2E11CD33126369F2DEB263CE116F207BC692F0A7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877669, "uuid": "28b90285-befc-45e1-9c27-58b76b9490ad", "value": "1536:fQn82DMDsGBGca94AlCZyese7CxaDFpZ9bfSYzGItiThlQA0GFpB:n2ADrBGc6Jlayef7C48hlQA0GF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877669, "uuid": "9457628a-c204-4d1e-92d7-01b2caae168f", "value": 75812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877669, "uuid": "9e123845-1b72-42db-a099-2776e3ace318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877669, "uuid": "2c6ae412-2f6e-4ed2-b52a-780f33a7dea9", "value": "mao.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62325d5f-fe82-11f0-a129-42010a9c0007", "comment": "Malware payload (XorDDoS)", "timestamp": 1769849639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849639, "uuid": "dbf8b5ef-1f34-4518-8e7a-6eca14cdb43c", "comment": "Malware payload (XorDDoS)", "value": "cce99e63a6107fc652a3f852a745955e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849639, "uuid": "944c6a35-77ab-4092-b5f8-fb6050e71320", "comment": "Malware payload (XorDDoS)", "value": "54c52935ba547039789eeec03e00c62ddf7e71006990b398bd4db6623343e060", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849639, "uuid": "85cc0156-1581-483d-83bf-3f30bed05a95", "comment": "Malware payload (XorDDoS)", "value": "28482d5b6a329d7ec46900a36f0812235e4a74e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849639, "uuid": "40ae03be-b751-4230-ae21-a88ad01429cb", "comment": "Malware payload (XorDDoS)", "value": "46640f0a3ebe54e361970428d141b6bdd05aea66c0aa5167e5bcac0c216aa1614f2e5d02e4860cc8bef1c697d93b1a4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849639, "uuid": "44972bc2-628b-44c4-8ca4-34cf26256721", "value": "T11B844B56E243D0F7D8270471234BF7BF4620A235D421DD9AEB94EE5AB9338E2264D723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849639, "uuid": "3847e760-529e-4344-a52f-85bc4e6f8cc5", "value": "6144:axnm9lfABacn+mKwrXW52+ipNTJVP3nWydo4tdZ9XpCz16MwYPFM5FgjTcxpM:4Ufrcn+vwK5ripVU4tdZ1pNL/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769849639, "uuid": "6816243b-d55e-499c-aebe-c38b760b9cb3", "value": 385454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769849639, "uuid": "5738b744-85c2-4fb9-9d11-b4165241e456", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849639, "uuid": "b7227daa-5a02-4acb-aed7-ef39b5823cb9", "value": "p.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bc7cc8-fe83-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769850184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850184, "uuid": "08cd39cb-658e-4bc7-b0ac-7c9bba1aac93", "comment": "Malware payload (Mirai)", "value": "5fb5361e604bc941c1b35d790d41c46b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850184, "uuid": "98687524-3245-430c-87d6-8039ba3f2bdc", "comment": "Malware payload (Mirai)", "value": "54dee15b51ebe5e6e132de9b5090b5f1abc2638f953bc082ff071ddd216eec9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850184, "uuid": "44a56632-e0e7-4a77-957e-4840d1c80dba", "comment": "Malware payload (Mirai)", "value": "955cd4965a981bc6c82c95f977fe7065d6a45548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850184, "uuid": "081de2eb-5ecb-4368-ade5-1c095c5f3c85", "comment": "Malware payload (Mirai)", "value": "647bbe80ae0b4fcd305b731a57256d92d9f38eb06bc8b8c5d00c966fc4623ef7f47c476c03f94c97e29e99132118c72e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850184, "uuid": "67d73152-4628-4d8f-9df5-e908174a7e7b", "value": "T1F26302F818301C53C4099666572FE8DA17DA4E7DAAC4D0884DFB2F289FF2699D178AC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850184, "uuid": "38d33c0b-295d-4381-9ef4-1c29beb8e1a5", "value": "1536:hjv5JSD2/Z05W73tqXu3Dg0BfWM3lnbAiB544QFRRZc4U:hjjSq/q873teuzg2J3W7RCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850184, "uuid": "43f3147e-a8f8-4d60-8f8b-8a29ab91d313", "value": 71776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850184, "uuid": "dcc36010-3b81-4a31-b7ae-63139c623ae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850184, "uuid": "7fb78715-41ea-49cd-ada5-662ec611956f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdc2811-fe71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769842517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842517, "uuid": "a311a1e0-cab2-426b-bffb-31be26936f19", "comment": "Malware payload", "value": "c2e3d523e4694e08d632aa144948b665", "object_relation": "md5", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842517, "uuid": "4a9fa335-b45a-4860-bbed-e68c9183d453", "comment": "Malware payload", "value": "55c5236bd4a519a34ab4a1beb8cb28e3e0cf9dca913406d90684280bd54f759e", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842517, "uuid": "5c02d13b-6272-4a69-9de9-a836776996b1", "comment": "Malware payload", "value": "87dca0d87542a606ec4f7d84bf0c2562900bd766", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842517, "uuid": "99e53f6e-ec5b-4460-9b09-bd5907b2a8cc", "comment": "Malware payload", "value": "0aa1e73ce915f79c1fb67556bd45a2a90a518cff5ddfde70825fe4fdea940df3f51e78d318582195fd63423847314848", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842517, "uuid": "70c44ac6-ec4d-4a50-880d-37a17e83018a", "value": "T16A362A39C7C714D5E4808F9AA2C9B237CE38B559977A33BE4C4EC16A057B8C442E671E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842517, "uuid": "1e331a65-2f46-4278-ad53-9dd993d828ed", "value": "bda7c4b70ee721f269d3e469bf3a8f86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842517, "uuid": "99753d53-ecee-4465-814d-9f27355fdb20", "value": "49152:UWVkc1iF+/C/3LPR1smdpalPAkDYkGtrQIqWOIO4hZ1PkQYfV:wri3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769842517, "uuid": "f6d035a0-7433-4500-b612-13036e1f0f86", "value": 5073920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769842517, "uuid": "678ac90e-eafd-4ea8-873e-66772dbd7a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842517, "uuid": "32fb00e0-25a3-4bed-a8e9-95d08e9caf8b", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc44c7f-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769861258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861258, "uuid": "b4d589c7-9b68-4350-b77f-a3640184df56", "comment": "Malware payload (SalatStealer)", "value": "f6fe6de5f6e19e2f72189673994fb5ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861258, "uuid": "785ca6ab-fa56-4b83-b6e3-53085354f698", "comment": "Malware payload (SalatStealer)", "value": "56010b13ba196204c5a46c63ae4a6e2f2c0b0c9c80ce0621f1724d75acdce4b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861258, "uuid": "236fe487-25bf-4e0f-a647-2703a7ea0066", "comment": "Malware payload (SalatStealer)", "value": "35e447f6e2781d99e44f363b46ae737637025eea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861258, "uuid": "2954cbb0-5d3c-47d0-998e-ca22b57ef7f7", "comment": "Malware payload (SalatStealer)", "value": "e8e49460dabb70cd76e711d106e1b21e0907a683ef56acac7185786f835cecbc08ded602fca83e8d8053109405d6449c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861258, "uuid": "abcd196e-afb3-4128-9282-5371917ef5bf", "value": "T12AC64B51FA8B58F5E9031831415BB23F33315E048B38DBABEB547F6AFC7B681196A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861258, "uuid": "f0e708dd-234a-4220-be8c-6fdb385a60ac", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861258, "uuid": "d0056041-cf7f-4de2-a3cd-3a92813b01dc", "value": "49152:tFtG+BP0KiiG8dYH9t7UpE63a3qQK44lxj78UMuSCN1+X25rTCJmv8KjrC2+RH0u:z8+BPs88CrMud+GlFj2j6RUzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861258, "uuid": "27eb22a8-6180-4093-af00-42b2e84a293f", "value": 11669504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861258, "uuid": "c3a9de05-a0ea-4b2e-b2ba-05cba9bc8812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861258, "uuid": "f15b8756-befd-4b68-a0aa-5ad640071b14", "value": "f8c68b6ae6daa9db37f1e5c16da98c4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9c86d0-fe83-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769850224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850224, "uuid": "ee2386ca-ebf3-44b8-ba77-1dba11086658", "comment": "Malware payload (Mirai)", "value": "781c15e171e454f4c90c331359d63b89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850224, "uuid": "f782b76e-2321-4bfe-b96b-7bb3e12bd2e1", "comment": "Malware payload (Mirai)", "value": "56ae385975e67bbecc480d6c887556ad08f9633b817dd36e0a80b122e9f77b43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850224, "uuid": "5a0e0c07-ecd7-4594-bda8-7c421c09cd45", "comment": "Malware payload (Mirai)", "value": "c6a18c2a148c9f4bee79ab672debef6338a6a3d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850224, "uuid": "772fe228-a4f5-42e9-956f-5f2d85941faf", "comment": "Malware payload (Mirai)", "value": "b46f2d5b1782e4789e029bc340ed2292b0f903aaef1c85f3eadf1ca82f6255cd32a1a49acb8a869e6ec09809ac66c37f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850224, "uuid": "9488c57d-571e-4edf-ac0b-efcff1354e3e", "value": "T15DF30842BD418F17C5D322F7FBAE068D3B166BA9D3EB7102ED206F9037864DA0936651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850224, "uuid": "80dae794-56c6-4831-b7ee-5a58a4e8d75f", "value": "3072:DUb3S/FM4tfa+vqz4TAY0N/hCVcmVB6hh1LLzC:DV/Dyz48YKpkXVALzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850224, "uuid": "be089316-7eb3-4171-bb87-d04afd0a9574", "value": 159792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850224, "uuid": "ead3f92e-68b4-455a-9c5c-3e3fc37a556e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850224, "uuid": "983197ad-5aa2-4a6f-b695-e30c3fb0a6d3", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89cc6a9-fea5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769864843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864843, "uuid": "9ea582db-5c7f-4b16-b996-c6baa7fb1dbd", "comment": "Malware payload", "value": "47cba68ea0202632467e1ebedc5399c9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864843, "uuid": "01ebd505-782c-4ff0-b4ba-4996fc5c1137", "comment": "Malware payload", "value": "57f763fdaa0603e290d1a8611f5b7f3bcb7feccf0c4f87792b0a5e3bf37ec6e9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864843, "uuid": "694a121e-2841-411b-a721-48fca1599d2c", "comment": "Malware payload", "value": "127a3604fc34652595f5f372e858086d1a31c50a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864843, "uuid": "7bd9907e-9868-4b7b-ad1e-50658e20a22e", "comment": "Malware payload", "value": "4c9fbcd002a4a1fc2667b6643dffc6ccfb037fc54c2475d757987efb1540e4c7f7a5ec3798278a73d15aa2b174dc47a5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864843, "uuid": "07d9ed34-2d60-46dd-9a29-3986596ee54b", "value": "T132863354737010E9F9B3963F9A55D09263B2B8228B60C6DF07B84A9A3E173F25D3D748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864843, "uuid": "7f28f46f-dc90-4f67-8385-ca8e42443cf6", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864843, "uuid": "e3f20c59-b2a7-44fa-b813-86ce600d726e", "value": "196608:SBThfXtbW897G9r1LDsBTG9WdEWQ3P/R6:sfX1U3sB1KWQ/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769864843, "uuid": "370e04be-4730-48ba-aa77-ceb7d70e0158", "value": 8609595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769864843, "uuid": "81aa3684-bf76-43d9-9a50-99115e157205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864843, "uuid": "bc42876f-67f1-48cf-9a9a-b3a2bf55ea39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe12601-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884612, "uuid": "6b225a8a-f5a4-4fea-8614-dffdf8ac7d0c", "comment": "Malware payload (Mirai)", "value": "a6a863b8fbcaaf5c2acb142a5fdc68ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884612, "uuid": "8e328e9b-f877-428e-af1a-bdd526c51866", "comment": "Malware payload (Mirai)", "value": "58063de42c8bf4d8789055ce8c40184cf1e792847fe902922f64af91282c4f4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884612, "uuid": "78d33dc4-02d8-450c-97cd-5c3f0a56a02e", "comment": "Malware payload (Mirai)", "value": "48c2293e679696b24bbfc0ffb8e5cc2246de4efe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884612, "uuid": "14615d83-48dd-4b70-9ee8-13be6f2a3283", "comment": "Malware payload (Mirai)", "value": "5b1e2ddd1839781267fd334bd4f7110f7a62d89e968b14344c67e7b4586f785288aac5a585529f1780c56a6b714c024c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884612, "uuid": "4c2dc284-786c-4c4e-aeaa-eae276efddad", "value": "T1FA438D37E96E1E74C04641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884612, "uuid": "d0e293fd-6a6d-4c54-8797-d9ed2ffbaf9b", "value": "1536:Vaa0brW/Od9hlCR3KaPKYXwKEpPDCMC2+WK:Vv0brWGd9X5aSYypPDL+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884612, "uuid": "a4965f1a-d6fd-43e3-aa71-144937f15414", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884612, "uuid": "fc3da5b4-0705-4a9d-99e1-eadf5aafd5c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884612, "uuid": "53bb3df5-c522-4fda-8e9b-d0bbba7262ad", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04be7a9d-fe7c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846905, "uuid": "024f1c1f-2be9-4e86-8030-c1870cfa29b9", "comment": "Malware payload", "value": "80f8ad89d431bd4dbfe835cff0059057", "object_relation": "md5", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846905, "uuid": "32c8e7a1-2330-47df-a9d3-b575446a773a", "comment": "Malware payload", "value": "5a6c22066a65d16fb5c080df69bec2c3efeedbe3beff8dfbe44aaa723b20ddc4", "object_relation": "sha256", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846905, "uuid": "18bd4ec9-0afa-4105-b6a9-cb6bdc6092b3", "comment": "Malware payload", "value": "a127dcbf95f893f8d977fc07c379fb9d533c669c", "object_relation": "sha1", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846905, "uuid": "6df56037-fd0b-493c-b591-b972b2884dbe", "comment": "Malware payload", "value": "3ec7e1aaec43b774498d6e1404c4a4d2b2ba49fe2386935d8d2fcc9bf771822f2da12f6ebcf59ea509ad667e2c753af0", "object_relation": "sha3-384", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846905, "uuid": "dd2b630a-6337-46c9-966e-ffd714365a1b", "value": "T11AD533776CB40CDB96C62D1DA97F3AF3E06A97A2470985F916DD7309C046B5B07E200E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846905, "uuid": "86051c40-7a20-4183-8854-3513dfb95307", "value": "49152:0fZ7KAhFj5qg/0FbjWpEDvn1iizmizN6PK+QYCn4ZQeyneUT3495:0fAA5qJbj0EDvQWmQNDx4WeynpTo95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846905, "uuid": "08151cc9-89f7-45cc-abdd-75cf812b16f1", "value": 2920134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846905, "uuid": "513e69d4-54a7-4f51-9725-a2eadbdc66bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846905, "uuid": "3ca1c1d4-8b99-47f6-8dba-2ec9de911f58", "value": "classes2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c96dd2-fe71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769842231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842231, "uuid": "58789eb6-01f0-49bc-8258-fad51f030d5f", "comment": "Malware payload", "value": "d82f2b1f64594d83572daf04101dde70", "object_relation": "md5", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "homepage-hotel-reservations-com", "colour": "#31E879", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842231, "uuid": "5139ae46-aaab-43f1-926d-ab32a16bdd2a", "comment": "Malware payload", "value": "5a789fb061504f801d9e318d6452c1bf523a4403e980e6f329604f5c171275cf", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "homepage-hotel-reservations-com", "colour": "#31E879", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842231, "uuid": "48dacb0f-03ff-486d-9557-01715a62d221", "comment": "Malware payload", "value": "e0a4aada7a0448736c1369ff251825d318cefbb3", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "homepage-hotel-reservations-com", "colour": "#31E879", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842231, "uuid": "1c7c03bc-b1ee-47b1-9c2f-5dae7071c2b4", "comment": "Malware payload", "value": "fda0d8bf8bd95fc131d7167c500504170674bb31037e6ce8ba5b205ae39454144561ca29883acf440ebd0208dae85cc9", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "homepage-hotel-reservations-com", "colour": "#31E879", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842231, "uuid": "6981d1e2-9d1c-4281-93ca-e0e9add9fe81", "value": "T18B75337CD2E2ABEF0A830C158CCFC356F5A05726BF5B9A3D7594C361A6A237542F1068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842231, "uuid": "b7663a00-2e8e-45fe-8998-186a5b76881d", "value": "49152:xBSBHxw8C8gkqtFhlgWFazE9apAaaUiMYldFt9TG:xBSHw8k7hlg9E9raaBjvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769842231, "uuid": "4045f5f7-3133-42b6-b5d0-be8f6f64b537", "value": 1654709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769842231, "uuid": "55217088-e31a-4924-b81b-ed02274c3715", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842231, "uuid": "fceee510-46d0-4d0c-b7cc-15fd01c41c83", "value": "qslemalfillempha.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3aa514-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877684, "uuid": "5ee13fc5-81d8-4aee-a8e9-45deb5c4f37a", "comment": "Malware payload (Mirai)", "value": "f8a7d445a2d8d24817e89e8719aa732a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877684, "uuid": "0cc921fe-d746-4878-88be-0272b931b568", "comment": "Malware payload (Mirai)", "value": "5a85876c444eb38221bec627bb6887cf041e4f4aeea4e5117f04121ee88a59d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877684, "uuid": "378eeffe-0415-48e9-8fad-48b880010f49", "comment": "Malware payload (Mirai)", "value": "344b60ab6a9a994d294c0719e760d2ce125902a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877684, "uuid": "a8062459-7d09-471d-a1a0-22242037a8eb", "comment": "Malware payload (Mirai)", "value": "3dfb75440eb16227aa9bd46871cd33558d8d2deb49598737b3afdaa571928abe4338224edc08dec8e1f5d96305ee9fbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877684, "uuid": "7b64a802-e26d-4a34-b0a6-df4a80b56ea0", "value": "T187531A89B801AF7CF95FDAFA41164E0DF961A301A5830F2B6767FDD36C724A58A13C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877684, "uuid": "224ec16b-0dc8-40dd-8426-9686fdbd000c", "value": "768:ui4nHrUePzer5OnrMi+lQi+u3pah846jXGYftt9hY48SqfuEgZ7UMICBeqooe2XV:ui8rUePzEOQfnOYfNG48SWUZ7UTCUqtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877684, "uuid": "8a4500a4-af37-428b-a5af-5b387a6fcc87", "value": 65620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877684, "uuid": "7782a833-e769-4fa0-aa60-f605429495ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877684, "uuid": "daebe9f0-1196-4b2f-a1e7-464070659f86", "value": "mao.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c6ae96-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846645, "uuid": "5dbe6262-b1ef-41af-ba34-aa117d86ce6a", "comment": "Malware payload", "value": "ac5a30d359d95f7881c9f6ce82029eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846645, "uuid": "6c60ca5a-89d5-4976-be2f-af167efe844f", "comment": "Malware payload", "value": "5b47831e288bc98e3aeff9ccf6c8e25a17747ccd4c5c429fa2994308249cb893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846645, "uuid": "17056660-f8d7-4f1a-8924-abc49b2b5391", "comment": "Malware payload", "value": "f62d72ed0437e96c8658606db3c9c434c2123e9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846645, "uuid": "44bafd45-48d3-4260-ba70-c1d4deca150d", "comment": "Malware payload", "value": "464ddee95e5a04f028533671fb7aaa9e6d66d9e843732d58bfe24dd679eb019cdb8f8ef1312691ccb0757fde66d9f557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846645, "uuid": "839551a1-e2e8-46a2-96b2-159444424738", "value": "T177F36B17B3A600BBE4739238C9A31A46E772781557619BEF03A047756F273E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846645, "uuid": "0f1701ef-c1ea-4725-8dc9-f8ce843b1fe6", "value": "f9f0e87ecf133996a285a6a9b5271211", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846645, "uuid": "77a5cc52-831e-4fe1-bd5f-da2f1ff26a3a", "value": "3072:gvQ9/FcF7ux44OAxAMYZ+FknXJCjWKUWqGNk3WsPDKVZS28te:gvwAMGU1LUWqGCDqS1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846645, "uuid": "f877e13b-5074-4539-a5af-295b4710d71f", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846645, "uuid": "798dfef2-2f71-431d-9e78-fb1f82156a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846645, "uuid": "35f846ee-2e64-4864-90d1-fb2d3445f58d", "value": "5b47831e288bc98e3aeff9ccf6c8e25a17747ccd4c5c429fa2994308249cb893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04014b65-fe41-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769821564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821564, "uuid": "587c4aaa-b7a7-4dba-a621-bc3257f88973", "comment": "Malware payload (Mirai)", "value": "7a9ceeea29f4fbda13e24e6d1b7283b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821564, "uuid": "389ce38c-7da7-4a23-98ff-8c9cca9a50c2", "comment": "Malware payload (Mirai)", "value": "5b9bc43e3fb9b722710967b63ef24642394b9a6b28408c9403d2c48c228e58f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821564, "uuid": "18521065-df5b-4cfb-b2a6-0ec76aa08e6b", "comment": "Malware payload (Mirai)", "value": "41ac11157874ff0b39bbc304cb42b6cca91c5429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821564, "uuid": "292f50fb-b296-45ab-a9a7-ed96516f4354", "comment": "Malware payload (Mirai)", "value": "637cd170d0be3d07f74d778b8473fc53e0100f45b905e4ff69340e1176f48e197be44ac5b5e84f4a0daecda49c306177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769821564, "uuid": "0b7f9011-136f-44e5-b890-b853c8088781", "value": "T1A0930ADABC858B11D5C5267AFE1E208D33134B78E3FE7213CE185B2E574A86B0A3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769821564, "uuid": "c7a72b75-6b25-4208-acbc-2a5147b4485b", "value": "1536:/axnRoc69W9ch8gzmRxaWENzYfOTZ7psRzTgveCrIwsvMxiSWQic9TQB7DJY8X:/q69cngzyxaWENcfOTZ7py+eCRWQic9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769821564, "uuid": "0fc4357e-e0c8-4390-bfa5-6ecf1d415a3e", "value": 91512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769821564, "uuid": "8c5ae95f-57cd-4e99-bb9c-8c683ecc9c99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769821564, "uuid": "848b8911-caa0-498d-961c-3d94bbbddf65", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224f104f-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846525, "uuid": "79088957-4d9a-44be-b3d0-995cc9667db7", "comment": "Malware payload", "value": "cf1353bb6e28830ed8ce846320aad45b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846525, "uuid": "22c04448-19f5-4997-8603-b81a8ce7ade7", "comment": "Malware payload", "value": "5e1cfa57771084629c2b08757f38d67f0ad28faa412090f1c6ef3fa0fd893bb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846525, "uuid": "08dbd0a0-e300-4dc6-8e6e-9024fcfcbe16", "comment": "Malware payload", "value": "8b103d0aa37e5297143e21949471fd4f6b2ecbaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846525, "uuid": "ee863b97-747a-4c28-9e8d-60695343eb6e", "comment": "Malware payload", "value": "6b0b5c21a325619c317092aad5a7b2eaa26dd07d5bf9c5482badc52026a5a12b5a9215ee76d2f204810ccc4d317ea2cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846525, "uuid": "f3c7a56e-062c-4c28-8fc7-6e93e859fd60", "value": "T166057C5AABB400B9D17BC178C5474607E7B3B0551760A7DF02A4CBBA2F23BE2663B351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846525, "uuid": "d89eb0ff-3452-4d42-bee3-b3b33a975df3", "value": "b7c39366591e2948dc8ba447d32770af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846525, "uuid": "4c65c6b3-a93b-4d94-8d28-2c1dd65080d2", "value": "24576:SXI1TB95QbjzeZIGS7+RHRA3+A1UFo5nEuesFrAEeen5CUPM:S4/95QcIG0+RxA3+A1UFo5nElsqmCUPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846525, "uuid": "f13a8847-5920-4f32-828c-c3584daca151", "value": 797880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846525, "uuid": "8f87b282-6670-4130-bca4-70f97aec1c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846525, "uuid": "5802d79a-5403-4149-9e7f-dc8139a9b859", "value": "5e1cfa57771084629c2b08757f38d67f0ad28faa412090f1c6ef3fa0fd893bb3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df6aff8-feb1-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769869872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869872, "uuid": "088935cc-2d68-4304-a9e6-15aa111e0c64", "comment": "Malware payload (ValleyRAT)", "value": "c020897e864c09809dc03ec392a63f34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869872, "uuid": "91249c09-0071-4645-9abe-55b7a08e8371", "comment": "Malware payload (ValleyRAT)", "value": "5ee01a7ec5257373175090e2bc23fae980ac996325ffa4bffc5bd53164c21d49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869872, "uuid": "eb2130b7-2178-4365-b9e9-fe2bd2db1cea", "comment": "Malware payload (ValleyRAT)", "value": "73d6ec213c7496cf609a6346fd450d7770625308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869872, "uuid": "e9958cdb-addd-4b61-8e3f-1778f0fb6fba", "comment": "Malware payload (ValleyRAT)", "value": "a4c8e88f6f9dbc2a78bbb0bdada1d88c44cca053c0cc7f5beaa587a409d5647aa46c4c5e6f2dfd59193ca5d70ffbbe8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869872, "uuid": "de093059-e90c-4c33-a380-57696b7c06dd", "value": "T11C47339302508E9BEF385D7ED293219C7E31BD37A502325B7A95AA02BC52106E37FD71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869872, "uuid": "3ee82f6d-3adf-41c0-a62b-267aeb652221", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869872, "uuid": "454f4061-4ba0-42b2-b167-3eb8ef67ca10", "value": "786432:UbHsByEMjDcB0izBfrTcrZ3hEaQ+/u2sQCo5A5:usByzs0izBfr4r1Gys/oC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769869872, "uuid": "05a0d7d7-f9b4-4cf4-83ac-f3aa8e60e93e", "value": 26133383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769869872, "uuid": "d8b05cc8-00ae-4b41-8f26-0af1a1be0392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869872, "uuid": "149614be-5ec9-4d66-b852-373c376023c0", "value": "Chrorneca4d-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418098d0-fe3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769820808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820808, "uuid": "39a95304-77b1-4d59-9306-772aa6128a4f", "comment": "Malware payload (Mirai)", "value": "6e2e2c5175b7d4a3f81f2d06216901b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820808, "uuid": "cc67c68b-f429-4fbe-9992-f884294c765a", "comment": "Malware payload (Mirai)", "value": "5f458387c47901cfc929a2fc3383db4b8ae65531266fe39fd4202c122c1aaa46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820808, "uuid": "9cf79da8-40a3-4ef5-a423-350a41cff1a9", "comment": "Malware payload (Mirai)", "value": "b105c14d70d5644976e7c3658e90d22e3d3b4e05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820808, "uuid": "e0343d6c-eeda-404d-af76-125a45748d56", "comment": "Malware payload (Mirai)", "value": "02e728f38cc73c4a658e52ecb4fd6778b57b140e907ff7f37e9b4b8071d64729e022ce1e4df29d74bec51647bcb9f6d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820808, "uuid": "9d1ec4c1-dc86-4705-b337-f105758e7fbc", "value": "T18443710ABF650EB7EC6FDD3709A9174524CD651B21A87B3A7D34D81CF20B25B19E38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820808, "uuid": "0d224d5b-93df-4eaf-8e3f-017867303c64", "value": "768:oLWu89xw1IlGGIunNlFgdMR+e2KvDVub3w6h12pcS5+46kjU4Z/eT5tIne2el9e2:oLWu8fwgI2M0Lg9gzi9S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769820808, "uuid": "1e556c7c-1e08-43c2-af99-8b33d5d70f03", "value": 59220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769820808, "uuid": "fb941e29-4499-49f7-852a-f4377e97c7cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820808, "uuid": "cafd145a-49e3-4e6a-9858-072c90906fd8", "value": "0upmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c193dc5b-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876857, "uuid": "97525280-0519-4514-8893-f6655e177ec9", "comment": "Malware payload (Mirai)", "value": "2ef7c80a334352042ea283fe87c39e08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876857, "uuid": "7d39026f-f0ac-48d6-b5d4-a28621b5330f", "comment": "Malware payload (Mirai)", "value": "6007605660aa2eed2e3f4d739e09c17810f4f9d5eaaf1e9e1635113dcbfbd556", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876857, "uuid": "d680c3f4-951e-48b9-9495-0c6f723dbb16", "comment": "Malware payload (Mirai)", "value": "fb7224244471fafe738730ebe7ebdc940ec6887b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876857, "uuid": "9ed76545-f833-458a-a596-c5184eb9f545", "comment": "Malware payload (Mirai)", "value": "1704c42261ec3f2ba805d3b66c9b6cdea7e1af483358f11c561b726c6f25fe948d1de6527645bb063c5d1818e6306ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876857, "uuid": "67838a57-449c-4570-9710-cda0e36f720b", "value": "T107F33A02770D0F07D15329F02A3F2BE087AFEDA62DA4B580742FAEC59671DB62545ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876857, "uuid": "b6e0d405-cbe8-4748-b518-67e56d3bcd2d", "value": "3072:kLdkmbPsPAL2hb95xaq6utFw9kDon+G6hh1jTlNX:AGmonPxajutFw9+G+ZTlNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876857, "uuid": "3e4f8b91-dd15-4730-bbe0-9b8afc062fea", "value": 159320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876857, "uuid": "d95661c0-afe6-4d99-be7e-e8808dc8c387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876857, "uuid": "7b76304f-f240-4346-8d0b-b01d7b8d5eda", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecdb71e-fe3a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769818951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818951, "uuid": "4bd35456-7880-4966-aeab-7f5faafbd77f", "comment": "Malware payload (Mirai)", "value": "95e6f74ee02415736e014dc7d08ebced", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818951, "uuid": "6a7e81fb-8f75-4618-81da-cab2e41bcf30", "comment": "Malware payload (Mirai)", "value": "61b328239b9a9c0edc655368ea83f776ec124250e86f503a4ca521d0de03f386", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818951, "uuid": "627e1c90-fe7b-454d-9a2c-425ecfbba7f2", "comment": "Malware payload (Mirai)", "value": "65d0e006bd371d4f7d075183e36c43e0b4ad3147", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818951, "uuid": "d9f293a1-cc9f-491b-9330-1c23ae3b3c38", "comment": "Malware payload (Mirai)", "value": "17b1338e21d12f1568413e14c76d7a5f169709ef0f389df5cbc56e88806a7a078de0ec4d309319ac13d73db733631792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818951, "uuid": "bc43a580-bc08-4ee0-9e38-c982a4821d6e", "value": "T15143971E2E619FFCFBAD873587B39E219648339216E1C684E15CDA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818951, "uuid": "00817300-e138-4423-8209-3854d61dd967", "value": "768:TDul5U9mAG5Y2zrEI/fEInwa05zNx8jMyOFy26OybGFjFp2gnAOxAWsFnkPDQFe:Y5smAG59zRqn5zNKlbGFjETCQFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769818951, "uuid": "59857c3e-c5e8-4dda-aad5-a0444be9f049", "value": 57092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769818951, "uuid": "7b909374-69e0-445b-bdb1-6648284a622c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818951, "uuid": "7a803dd8-f41e-469f-9d15-3bfa41c10809", "value": "0upmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c785b877-fe40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769821462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821462, "uuid": "70a22ac2-e142-45c6-b7c2-9bbaeaf75d96", "comment": "Malware payload (Mirai)", "value": "c027bdbef1c82b03ebcb0b5afaa70d21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821462, "uuid": "f8fd4566-8db9-41e9-bcca-06abe3847344", "comment": "Malware payload (Mirai)", "value": "62a576f8eb715ce1955df83f199ed98328e2c5d9fbe945126c883b02543018af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821462, "uuid": "4f680ea2-5cb9-4dda-97f5-c59f1d5491ff", "comment": "Malware payload (Mirai)", "value": "328260b3192ee5dcb70e1bdc38d9efc0f7d15c96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821462, "uuid": "42ccae27-ac51-49b9-b771-426a664fdc76", "comment": "Malware payload (Mirai)", "value": "24c05794e7c89ac47557c9321d1ed360100c9c9039f389bab65df7b1500b7aeebf1a2b591351401fe2883608192dd904", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769821462, "uuid": "65569b71-2de5-41af-b0af-cac637d9dd8d", "value": "T193C45B55F8809FA2C6C42576F75E829C33174B79C3EBB20699145B343B9B86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769821462, "uuid": "cd97ff06-3c9f-4576-9cf6-74f2c22646ff", "value": "12288:6SX8K/oFcg0XxBTFczV2cDD0gIt5gpuorNV:DX8EjTFc80DbItIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769821462, "uuid": "4fffc463-5cf6-4a91-8b2b-3a3e80ac19f0", "value": 554308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769821462, "uuid": "181d0358-9040-4c5b-92fb-5448899e50a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769821462, "uuid": "d2ac3590-3098-45e9-8197-04ccb4cbb20a", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40cb49f-fe9e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769861829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861829, "uuid": "04438b8b-5c7a-445a-94da-db5f67f400cb", "comment": "Malware payload (AsyncRAT)", "value": "692a5ab1c371887aaed5986cff42b3cf", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861829, "uuid": "e6b92e65-abfb-4a4b-a2d1-eb832153d274", "comment": "Malware payload (AsyncRAT)", "value": "62b0f6a41b6027c2b82ae449bfef9d8a6f682d77d47f1ee019e701e9d494ec65", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861829, "uuid": "0171916d-91a1-4923-a14d-acfa20d0703a", "comment": "Malware payload (AsyncRAT)", "value": "46854a3850065a048e9d3306e27ccb3f2a0928ae", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861829, "uuid": "eba066d6-c074-4fc5-b071-c498fdf979bb", "comment": "Malware payload (AsyncRAT)", "value": "08f7d64089ea6d5be5c5f663a8aa4ec63ed565307a8f2c5600b9e936362e7536c8bb68a7e956c6f3822d77d336a2d4bb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861829, "uuid": "52315b9f-2bad-43d6-93b2-97a2d0361330", "value": "T1C5D23A08B3D48562E1FD57B94D7292048771EA5BA973DB9E1FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861829, "uuid": "299199d7-9fb5-48f7-a5a7-70ba304cd910", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861829, "uuid": "6b925988-b19b-422c-a6f0-b525dfe353f6", "value": "768:MOBRXuVX1kYc4g/cIRGqoe/Rb7fB/dT0/+:hBRX21kYch1iQRbN/m/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861829, "uuid": "612c7d03-c874-473b-9732-7d98ebb30489", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861829, "uuid": "3754430d-6b73-4a36-a094-fc0e87cc9637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861829, "uuid": "894f598d-6333-494a-8a87-81d0d579da53", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138e767f-fedf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769889450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769889450, "uuid": "f9e4d0b2-d3e7-42f7-9dea-772c8f0c84f9", "comment": "Malware payload", "value": "bfde02a2c7b20dd8448c2f21c11aa25b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769889450, "uuid": "198d056a-8313-4898-95ae-0eea273491e8", "comment": "Malware payload", "value": "6372261bfdc4506357647caabf48020ff8af659b8e059f57bfa28203930ce5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769889450, "uuid": "9eaadd87-5ddc-460b-99bd-994b34d9df6d", "comment": "Malware payload", "value": "2adc67bfd6246fa03f94b212c1fb9273468a506a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769889450, "uuid": "51016903-6882-46bf-8115-b62eac399cf6", "comment": "Malware payload", "value": "08cf04629f01c129a6706c686e89c35ab9f9e90760e8ccfaee1d36e246a1eb2e2c921d49bb79308757078a9cd5cbb751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769889450, "uuid": "b4ade6db-e871-4426-bc6f-b4e9b77697e0", "value": "T1698633D224989E72D856893DE05B9DA845B53C3A86FCB0243DC17C0518BBCD1763FBEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769889450, "uuid": "5f527d31-d631-4dee-80a9-7dd63d82fff2", "value": "6b37282d60262d7b3ad69fd51a6741de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769889450, "uuid": "11b493a6-6281-4dd0-96a1-0ed0b261d5fe", "value": "196608:VvKo5i5vzD2eW0O4QcorHst+jpjsGycdB0Oi84S:vi5vzCePorMt+Vt5DtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769889450, "uuid": "865b96a1-7579-44de-927c-addad1cbb8d3", "value": 7853056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769889450, "uuid": "884bd7ec-9755-4024-9374-b5304dac2010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769889450, "uuid": "6d00117b-2440-4777-b047-0717fcccc383", "value": "dmg-aion2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ce9f71-fe85-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850774, "uuid": "80ad4a07-e47d-4dda-8b11-2508e51a91d8", "comment": "Malware payload (XillenStealer)", "value": "e54cef890e7d38b80a73e60bb19666fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850774, "uuid": "7fb4d149-1e58-4f24-a8e7-5ad0b9ec7655", "comment": "Malware payload (XillenStealer)", "value": "6382c42064d364bc19462f8c277d82c03b8eda1b31509c834f0411c8cf7f4455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850774, "uuid": "812fefe6-158b-4778-9485-f1d150b7c57c", "comment": "Malware payload (XillenStealer)", "value": "52795a3f0f0eff71d5c5b95e3d1a8c9f1d198cd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850774, "uuid": "23e5ea1b-2b63-4fb9-9557-896a62c1a432", "comment": "Malware payload (XillenStealer)", "value": "636ac6a062bdc36f8a82a1bfe2fb8ab5308b086eb9ed4b3bc5b3a399f14008c08343443cc31d1e216f325c2497b722ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850774, "uuid": "b36766e4-804b-4474-83b4-aa6499c56b4c", "value": "T1D28533B8793B4120E347FA7AFEE31355CBB411E277DCD22D8A1805A88243E95C5F746A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850774, "uuid": "a8ff648a-adb2-4730-80ad-fe42d78b1ead", "value": "e0a2c0168120df22501a39283b15736a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850774, "uuid": "70f8be67-8f41-44a3-a02a-8294d944677b", "value": "49152:jxh07dVpobbcfxtyVOz+y2t4Vql/CYxy9Crhns24npg0vB9J6:WDpNf79+9nECJs22K0vBH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850774, "uuid": "bc3b2f5b-2729-40ad-9ffb-6285abf3b304", "value": 1781048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850774, "uuid": "13892f54-31a0-4ddb-8333-22ab7bfa3805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850774, "uuid": "0843cb62-3ff7-47f5-a0c0-31cce4faf48a", "value": "LatestTest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2011fd-fe52-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1769829147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769829147, "uuid": "b31defe7-c5b2-41ff-bf91-2c075f3b3acd", "comment": "Malware payload (DarkVisionRAT)", "value": "9d0672f1d51b9b59a3d988018c75e40a", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769829147, "uuid": "8f901071-b62e-43b5-9bae-27069a402bca", "comment": "Malware payload (DarkVisionRAT)", "value": "65282120f7a6a3da9514d0e5c54987947fde41c372fb4a477b8590c9a8048ddb", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769829147, "uuid": "f98a50d8-1350-47bf-9882-0e407fb68599", "comment": "Malware payload (DarkVisionRAT)", "value": "4c4db21707d470bd6bf0cd1c900aba67a868fcf2", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769829147, "uuid": "09df62f0-9354-42bb-a2eb-25a1e8eefa13", "comment": "Malware payload (DarkVisionRAT)", "value": "86a1cc9e0d624afa2628cb26675981772998a0b59140a49e6e967a83f0b345f9e59c680ef49d05cb61457701e6aef479", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769829147, "uuid": "ce006139-217c-46de-a7c9-2fb1a224bb5f", "value": "T170B523A6294118FEDC27DA30D1E3BA46B6473F038DC4659F6398F96907B63CBCB11606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769829147, "uuid": "edf0b489-e1f5-4669-ad49-97d48f3956d0", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769829147, "uuid": "f13d23cd-4186-4be9-b1c4-8656fe6d6d1d", "value": "49152:rLX2QolXQIFYZIdd27Vyeg8w73UUUqu370Bwfzxym7xGKoNcm3izbPReAdnX7St:rb2v1FYZ2VEhquLfzxhJoNcm3iHvdX7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769829147, "uuid": "ef3199e1-fcd0-4e89-9dd9-049e1453fc47", "value": 2355632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769829147, "uuid": "84200d15-b428-4e3c-8020-704ad8340232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769829147, "uuid": "62065944-7279-4cd1-8c93-a44e71416384", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9f24ce-fe7a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846355, "uuid": "f9f7a1ed-e8be-46b8-8354-6a22739b0744", "comment": "Malware payload", "value": "35e4e8520c5cfb8c878461d88f7b61a0", "object_relation": "md5", "Tag": [ { "name": "win64autoupdates-top", "colour": "#E74210", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846355, "uuid": "a23fc724-eaf2-4c3e-83b6-c43eeb4df4e6", "comment": "Malware payload", "value": "65e0ed2d0fdbc959803a07001b273a846a514fccc57eab1a591eea69028cea57", "object_relation": "sha256", "Tag": [ { "name": "win64autoupdates-top", "colour": "#E74210", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846355, "uuid": "ec9621c1-b27c-4c81-91b3-af2f7e5ab3ce", "comment": "Malware payload", "value": "c4fd5c121980ed606de0e7946db68042aa89b3bd", "object_relation": "sha1", "Tag": [ { "name": "win64autoupdates-top", "colour": "#E74210", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846355, "uuid": "d25b32ef-ac8f-45f8-acad-4d0e7d43cc2f", "comment": "Malware payload", "value": "8d542b50f831554740731ed830849883b2cea99856db536be797e6e60fec2658fb1bcdba9b49b2a669b77483fe4feb38", "object_relation": "sha3-384", "Tag": [ { "name": "win64autoupdates-top", "colour": "#E74210", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846355, "uuid": "c95502b8-3388-46f5-a18c-707c61fb9183", "value": "T1309423E28FE8AF24EE4DD09D1CAA4B4E570F25A654061F0967231AF11F2F528DAF0C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846355, "uuid": "ca78c7f2-4630-42ab-9f1d-e5668a67c76b", "value": "6144:XFdbdb4q6nlsj7yvG0qzdaPTV0mw9OVi1xCdLaHAt5hvqmUWnQgb9Phk26ms:Vbb96g+ydaPR0IVIlAxqxW95kCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846355, "uuid": "4596676d-3357-4dc8-8447-a0c73a43de76", "value": 441075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846355, "uuid": "0daf8e93-07ee-4b27-b9af-c30200046896", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846355, "uuid": "c7e4e7f7-4aa4-4f69-afb8-473254fb0154", "value": "Downloads.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fe60a8-fe84-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850511, "uuid": "fe7a77be-e7a4-49bd-ad46-66ef328779e6", "comment": "Malware payload (XillenStealer)", "value": "2fd57ae6a4f3bf6f246eac323514ee01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850511, "uuid": "ea1c8fd5-a37a-4062-8921-ab6645cf3b97", "comment": "Malware payload (XillenStealer)", "value": "6715d8d5f2985ebafd0257ba2e06d757b8f0d65b76314617ea6de9e52cc4be7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850511, "uuid": "24ea6598-a128-471a-b88f-cbe6c0ebc9e6", "comment": "Malware payload (XillenStealer)", "value": "8b70c4edb491e83c79929eb344ad4282db9a07e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850511, "uuid": "d58a8d89-0047-4ce8-a913-5e0c9aac0bec", "comment": "Malware payload (XillenStealer)", "value": "153bfae4b5e58d481f68b9fca963cc51bbda6cae9d66f3d99c15805df9e45895c9f96a32e2c13654d651c725b9f804ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850511, "uuid": "3b878ed2-aeb9-4835-a69d-ae3bd70cbd06", "value": "T11CF59E17E66244EEC1A7C175861F9233BA30F85A16317A7F2B58CF292F16F604A6DF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850511, "uuid": "f056c044-36a0-4bdc-bec1-be1f8bb26bf6", "value": "ceca38aaf88246327be57ca0f6e1d1b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850511, "uuid": "b2835f57-db25-4af5-bf97-e81b64cb0913", "value": "49152:E6IsVHIz+zupGzKevKLLKKaaKKW7cu/YnM52AkgIv1vD+fOTRomvEdf:EcI8v/IXn39Tuk2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850511, "uuid": "e362b912-200f-4a0a-9d06-3fd3f70ae501", "value": 3517496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850511, "uuid": "224e410e-700c-4ff2-889d-1168798d02ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850511, "uuid": "80d28dc5-c84e-4b91-baa7-83ba2ba39faa", "value": "6715d8d5f2985ebafd0257ba2e06d757b8f0d65b76314617ea6de9e52cc4be7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dde55c-feb0-11f0-a129-42010a9c0007", "comment": "Malware payload (Tsunami)", "timestamp": 1769869426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869426, "uuid": "1e36852a-5a2a-4e24-b00e-9ab760cceee7", "comment": "Malware payload (Tsunami)", "value": "2052ec4a3d8a89a121ac0efa68f11509", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869426, "uuid": "b87d8062-5b6e-47a1-8b12-b29d97cf55c1", "comment": "Malware payload (Tsunami)", "value": "6730eb04edf45d590939d7ba36ca0d4f1d2f28a2692151e3c631e9f2d3612893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869426, "uuid": "64010d8f-04a9-4fd7-859f-e72b503d7435", "comment": "Malware payload (Tsunami)", "value": "2200245b6571d74c9ddc476fa3fa218d1a68f335", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869426, "uuid": "2419dfb4-4bbc-496e-a961-819016982f2c", "comment": "Malware payload (Tsunami)", "value": "cb4dad256484e2ab346751b965f3e59cb3fd326f90c7c1e484df369d8f7662aa7094c79c832dc9429ab50e978871354d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869426, "uuid": "c3619254-3d8a-4cd5-ab87-9d6ab31eea03", "value": "T1310533995BFF39828EA61CAD41E7DA0B07D62F9504FBCD0058E7028953D9133CA22FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869426, "uuid": "6806fcb9-38c4-40c4-a6ff-06d90ca97dc5", "value": "24576:VoG13EsScEPHXMWvDa1kt78govVlkTun78MzULIha:Voe3EUEvNv7g/vVlwwJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769869426, "uuid": "9365b54c-1c9e-465e-818d-066f9e051ce0", "value": 801436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769869426, "uuid": "887adba3-a6b6-4693-96eb-5f9f4c8237c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869426, "uuid": "6abd8aab-1078-4803-b457-945410eda73e", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5444a474-fe7a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846180, "uuid": "9f4833da-b656-45b9-b7b2-36d378236a41", "comment": "Malware payload", "value": "855cbb0c38dc63dd5625fdff29c98ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "win64autoupdates-top", "colour": "#E74210", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846180, "uuid": "25afbde9-7d57-4041-9e75-fb3438c676bc", "comment": "Malware payload", "value": "699f5c60295b24f0df64bdfe215dfa37b522fd9325d9150544175778019d7bf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "win64autoupdates-top", "colour": "#E74210", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846180, "uuid": "1d78a08a-6c1a-42ea-9328-c39ebbd0e980", "comment": "Malware payload", "value": "577dd818daf73f402ca3888e9a4ba551b63e899a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "win64autoupdates-top", "colour": "#E74210", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846180, "uuid": "5f8b52bc-b775-401c-9a63-6c8f9afdc9d1", "comment": "Malware payload", "value": "f8f88466623e8253e5f17d9e549f52dcd53678b2b95547f008bed485cab2eddd63ec8af48d463da83f183e0ce510509d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "win64autoupdates-top", "colour": "#E74210", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846180, "uuid": "3a7b0283-9a35-4bf4-8b7b-0a37d83145e9", "value": "T15D749D5BB1894F71CA480BB5C0A7411403E9AEC7B333D7453E5A03EA0E927F9DD85AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846180, "uuid": "692fc16e-ab88-4e4a-a7b3-e7a2df256ec5", "value": "6144:gaMwPZQ+/OlGWYIub5BBQVi1fCLrOZAV5hvwmOWnog79xhE26m:LPb/9oVINApw3A9rEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846180, "uuid": "bce87e30-2808-4d96-a4f7-244c74ebabc4", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846180, "uuid": "14fcc1ec-c0a3-4f0e-b998-bc7e5d115700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846180, "uuid": "753da7fa-4d40-4048-b01a-dee67743bbcc", "value": "699f5c60295b24f0df64bdfe215dfa37b522fd9325d9150544175778019d7bf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9196f6c2-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877206, "uuid": "5e1147f1-340d-47be-b3d3-83a651a5adbf", "comment": "Malware payload (Mirai)", "value": "7aac7586006d053cdfcc2c8a365e8bfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877206, "uuid": "982e30f0-c3fb-4ed6-9725-122b4ec86016", "comment": "Malware payload (Mirai)", "value": "69bf0b15ee82c5a38284d35215704fcad04f588b0afb64725e496581e9f8514b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877206, "uuid": "f9092be3-51b3-4062-bfd7-a1896bb74978", "comment": "Malware payload (Mirai)", "value": "e5df7c71778bd2e04c00fb45fc9d4934053de4af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877206, "uuid": "8ac42ec6-767c-4bde-8192-eb998f16c9dd", "comment": "Malware payload (Mirai)", "value": "aaaa8d7b405c747e8f3251236253d10e6218ba3fe71557a8d16a3d45402e54388431ef9c519e3f6239556d732422b3d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877206, "uuid": "4440d5bf-1704-49dd-ab97-1aa90c1c92a7", "value": "T1AAA3713F1B231F73D0D9203101672276ADAED70834BC8BDB9CD5586E2E1BA9834596DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877206, "uuid": "2d2f1ecc-718b-4f03-9bbc-f4e2bb91c799", "value": "1536:6/5kePpOljzPl5Ee9SIENSKFPW8iH+87b2e0Qd7t7JrE:g5k6SKyvH2i7JY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877206, "uuid": "53b59eda-bd53-4cbb-bd98-3d5fa0ec4cfc", "value": 101901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877206, "uuid": "2c00c6b2-76e2-4769-976f-5eeda67f45a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877206, "uuid": "b8f95ab8-3336-49b0-9809-e0652cea9153", "value": "bot.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa85fb4a-fefe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769903152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903152, "uuid": "af839dea-22dd-4169-a35f-522581473bfd", "comment": "Malware payload (Mirai)", "value": "d08921f9153c9408761dd25a81ff72e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903152, "uuid": "73d7616e-03f3-43a7-a16f-f37a26951db9", "comment": "Malware payload (Mirai)", "value": "6aef9086c2d6f5f86a330ce87530c11269efdf9cb4d8716d22365892eddda362", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903152, "uuid": "a2ae732a-eaa5-429b-bd73-5a1529dd89ae", "comment": "Malware payload (Mirai)", "value": "5139a6824346ffb219b904b3a7b2dc47d5f66817", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903152, "uuid": "7d127b63-f05e-4875-97c9-106693f29056", "comment": "Malware payload (Mirai)", "value": "46a44604bf7583608da2d894b04c31d2175d32a938e4ea2430d900e4da377678897ed1de0fc73df596b15dba945658b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903152, "uuid": "3530b712-4d79-4788-bdeb-a45b2b97aacd", "value": "T1D2F46C06F70C4573D9631EF02E7F03E6C329595304F9D51A260EA7A61636E3E9AD338A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903152, "uuid": "0eadafcf-7038-402a-82e1-a2253172261e", "value": "12288:bnRY4iLH2R8EbhHHflSI8ubLv9VidoXZkkTDIuipCzIHobUI/5rGvS:v9tflsulhnIiqooIBrGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769903152, "uuid": "593cc807-9a67-45f0-9e16-1aea0681f538", "value": 792192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769903152, "uuid": "da7aeafb-96e2-4ef7-b802-cbb44691fe43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903152, "uuid": "3126cbb8-a498-4554-b2cb-b0dc1714f4ac", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ff164a-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877675, "uuid": "eceedd40-2a6b-4791-8a0b-9e746c29fbe8", "comment": "Malware payload (Mirai)", "value": "2ca1dfceba2ae3d4186ff707df457c53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877675, "uuid": "b8c9db1f-956b-4b31-9734-1b347803d4f5", "comment": "Malware payload (Mirai)", "value": "6b096d6a6ff4ad70aa27c1e7f1bee577aec33e259639599fc38b12ce175e07ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877675, "uuid": "141e603f-3e95-4bb5-bd6d-ade508105a05", "comment": "Malware payload (Mirai)", "value": "783134f166a652068a77540073a2e63dd99e201d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877675, "uuid": "3ee60a0a-57df-46b3-b502-8f9e4550f427", "comment": "Malware payload (Mirai)", "value": "0b3db96f5d582b9149048fb0c3d3ef42d196446f45beebe6ddf445558b518d440351e9f01b498243d2e428633eb76084", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877675, "uuid": "80b294a6-c7db-48f5-b847-397b7c48b33c", "value": "T1CD635A11A83D2E17C4E4917E02BB8B69B2F5274F19A487AD7E320F8FFF505D4A5062B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877675, "uuid": "27278ff5-1f53-4686-a206-57f370ad7b08", "value": "1536:2wiydmb2IBBDAAnBdeIe7HGSG42kz3CFZb1G8iS:jKLNY7Z/tzaI8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877675, "uuid": "0e57bc13-4538-4ecb-9000-6f63ec9f4a64", "value": 69392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877675, "uuid": "85885b5d-4014-4fcb-9460-21976a831396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877675, "uuid": "bc39edd0-6a5b-4b16-a49c-8f9bc7232454", "value": "mao.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2a2ee1-fea3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769863858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769863858, "uuid": "482f93a2-85e7-4151-8b73-40b029591d22", "comment": "Malware payload (Mirai)", "value": "53167321cb1cc50a67c104a4aade24ba", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor:Linux/Gafgyt!MSR", "colour": "#DB6819", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769863858, "uuid": "c9104a5a-2288-4300-a642-7bad70fa1558", "comment": "Malware payload (Mirai)", "value": "6b46481f29c4bbe2b6984ada145a71ebdf014a4bb29dbf7d1e536f47e41229e4", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor:Linux/Gafgyt!MSR", "colour": "#DB6819", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769863858, "uuid": "d69a3c75-2399-4680-9ab4-a43e7cf88114", "comment": "Malware payload (Mirai)", "value": "b825160b437ec9450dca1e9f343e60533f670143", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor:Linux/Gafgyt!MSR", "colour": "#DB6819", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769863858, "uuid": "848d3fa1-dfaa-45f3-afcc-df2d9298ca91", "comment": "Malware payload (Mirai)", "value": "2687a06cf975e7ba409dd494f9743d9125d19e80c283e75acfecce7e9d2c95991b5430820c42ec2edcf67fec9ce48aa7", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Backdoor:Linux/Gafgyt!MSR", "colour": "#DB6819", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769863858, "uuid": "8e5d9943-aa85-4ceb-ae12-cd2ca220f893", "value": "T1C1835B02B64250FDC48BC1704B6FE927EA31BC5912397B7F1B81BA702E36F616B0DA41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769863858, "uuid": "2a59ed55-6d25-49ee-8e15-ad6b16439faa", "value": "1536:KdVTc7bHZtnokZDJFZ04lT03uAImAASlcKDqTCDU/ONorE:KdV47bHjoktjZs3IeSTqTCCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769863858, "uuid": "86705e3a-591b-4bf6-a615-871e9049992a", "value": 88360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769863858, "uuid": "5e0716a4-a556-4082-a222-d62f7be71d67", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769863858, "uuid": "d73f98f5-1fd0-4dfb-b98d-ff32d92466c9", "value": "gots", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560f50bc-fed7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769886126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769886126, "uuid": "ba0a03bb-bf19-44fc-9f59-08d9039c1959", "comment": "Malware payload", "value": "f4273691fadbff68526bf0ea36689774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769886126, "uuid": "32242935-8415-481b-a0ac-62f19f0f1f97", "comment": "Malware payload", "value": "6b7c5899cd5e9940e7e55096de15877a4633a4588f311b2f6c6afe1c77c8a67e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769886126, "uuid": "70f11e94-a725-493c-a900-bfc88ab2a2cf", "comment": "Malware payload", "value": "5106835db6b7045a2943e322b7d8f498ea11ea85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769886126, "uuid": "b9fe155c-3a84-4cb3-b45c-c9456753d9cf", "comment": "Malware payload", "value": "648c261ccaaf213fa4f1d374ba00bc45a37d2c84fe0f26aae884a5a81dd382d051cb0ca30ab6cb054e1ff9fceac061f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769886126, "uuid": "6da72595-01c5-40e8-a88a-c318f4cb7637", "value": "T1F1B45C627B21CFA8E325D67005F389555E9912A306F6A4C0937CDA10BF50B6E285FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769886126, "uuid": "de170336-1cfa-47e5-b12e-e51ee3d62c84", "value": "6144:WNWjCOVYQ9LVQDjnH8Egf6VRyZcq27StFIZqVXCuszB6Br/1SsNwYTi4dfrByxlK:YWj7oP6fuyfFI4V9st6BhSiddr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769886126, "uuid": "be789af4-8a80-4b11-a7ba-a5b0add23446", "value": 530666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769886126, "uuid": "ba5c67f3-6941-4c17-b138-ba8fa7d8f04e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769886126, "uuid": "80d7e35e-84a7-40c3-90df-db2eef28d3bb", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c7e141-fe9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769859799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859799, "uuid": "6394a918-6486-4def-9c64-01c7daf864f2", "comment": "Malware payload (Mirai)", "value": "7fa085b04200e09f49a7254bfc00af85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859799, "uuid": "a00a5048-dcb8-4ea6-b203-d266fa6afcbd", "comment": "Malware payload (Mirai)", "value": "6bd17beb9125a37a0130ca3d3707eec2ff5310693302f1d4b742294c4d74e018", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859799, "uuid": "09ba3eaa-2b6f-46c4-9468-2ce63cf01102", "comment": "Malware payload (Mirai)", "value": "acd18f141bb02dfb7871fa9b6e40e5e4da955826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859799, "uuid": "a5477fdf-b2c9-43c5-ae70-e5b560b8334e", "comment": "Malware payload (Mirai)", "value": "13ff8253812c7688131e7f9616bd9b7de0fec3e312935747ff0abf26e35236bdd73142351ba575d87b50aeca7a2f9aa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859799, "uuid": "e4c5b9c4-65b2-4e0c-95e3-075a7ef150a6", "value": "T11CB45C59F8809F91CAD529BAF65D529C330707B9C3EA720799245B343BC78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859799, "uuid": "921a76bc-d294-47bd-b5af-cf448d265510", "value": "6144:yETM6zpZCwyQuNwQ6rec2cXh3vJe4lpZv5HJKaRqssUInsXgKgvgpuor75Kr:yq52QY+tlphh8lUqswNgpuor75Kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769859799, "uuid": "74c4f46a-f9bb-4955-960b-c00904ecdafe", "value": 539806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769859799, "uuid": "5a6d195b-841f-4851-a8ff-fc24875d8120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859799, "uuid": "63382fac-3c95-492f-8220-db407a11429d", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe382cea-fecb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769881254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881254, "uuid": "5fe428a8-f315-4ce0-ab6a-318674e5028c", "comment": "Malware payload (Mirai)", "value": "450f357f2f333a59c2bf98fcd8b0dc0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881254, "uuid": "7d053847-4a10-4dee-9205-eccaa40d0407", "comment": "Malware payload (Mirai)", "value": "6cdf55e62b3742268523130d5b88fec612ce259dc8a7ca5a8d76d268155ff9dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881254, "uuid": "76110188-3734-4f24-9c09-0d9e97a733aa", "comment": "Malware payload (Mirai)", "value": "ac968d0804b29cc8d19c5d216ed4b3d1306e69fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881254, "uuid": "eeb71b83-d02f-4b4a-aed7-67f2b19f733d", "comment": "Malware payload (Mirai)", "value": "3504ea1268f51cd66fe26d0976341e4992b7d2aff6c978fec838eb409d16032710fa6ea8f8754458c993b3e9ced4d19d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881254, "uuid": "f8bcb6d2-f8a0-410d-b1f5-f5524483ee2c", "value": "T137F36C07B9C190FDC8DAC2B44BAFE126DA33F05A5134725F27C86E262E4DF216B6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881254, "uuid": "59f61e68-f473-4a10-86d5-a8504b44fc2a", "value": "3072:fmQ8+pRhkCC4e1RB51d1RopYpl0Zs1cQioGCG8HATY2kK0EOKT:iomnyTAhgD0EOKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769881254, "uuid": "9a612d64-d4e8-4ab5-8e35-9ee9efbcc571", "value": 159792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769881254, "uuid": "c64bf6fa-a858-4f69-b120-dd6b8018b626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881254, "uuid": "61666f96-ee59-48ef-a664-05d370d87c7f", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9066610-fe8a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769853301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769853301, "uuid": "0e8520f7-555a-4bf3-9705-456bda94e48c", "comment": "Malware payload (Mirai)", "value": "5b2b96cdd955ac6b21600ff7441a119a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769853301, "uuid": "0ffed097-a2fa-44f5-b512-0aacebd101be", "comment": "Malware payload (Mirai)", "value": "6cf62ebfc854988b9443a0648bd7af190737a218ddb6883abb48f6eb6fabf518", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769853301, "uuid": "96308264-2dce-4034-aa62-2bd62d2d4b4b", "comment": "Malware payload (Mirai)", "value": "54fbadeb2c1c10d1fe5f909d6ed1f72efd3709b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769853301, "uuid": "4a5fd2aa-d561-4ddb-87bc-eaa4e8e181fd", "comment": "Malware payload (Mirai)", "value": "0ef92ea83e876f521cd41678f2a01d42089abe6bb89a723ba4a6d82979f6b1c833186d459ffaff2cf8ea8ac22c6ff7b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769853301, "uuid": "39f3b7fd-fcbe-44a0-a868-eefbe857387e", "value": "T1D0C45C55F8809FA1CAD529BAF65D929C33070779C3EA720799245B343BC78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769853301, "uuid": "2008f8d9-092e-4468-bda8-4fa4f48b7cdb", "value": "6144:yETM6zpZCwyQuNwQ6rec2cXh3vJe4lpZv5HJKaRqssUInsXgKgvgpuor75Ki:yq52QY+tlphh8lUqswNgpuor75Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769853301, "uuid": "c6f9d0ea-32ea-48b0-bef2-d59c55614e31", "value": 554412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769853301, "uuid": "335bc3fc-2113-40ef-b2d4-328e1194e08a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769853301, "uuid": "b55c756d-01b3-4b75-b8b2-168b3ebd45c5", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817b0cfd-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846685, "uuid": "f08a0cb0-8a1d-4628-944e-04afb7537595", "comment": "Malware payload", "value": "f36accfdf2de181775e7562d1f6c3aab", "object_relation": "md5", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846685, "uuid": "c37c1cb4-02a5-4b2a-bf76-db259f241e83", "comment": "Malware payload", "value": "6de3b941749cbeaea1d1324016493bc40cf29b357c400857de958c11333d1030", "object_relation": "sha256", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846685, "uuid": "b692354d-df06-4bdd-a6b3-3f29d134d5d2", "comment": "Malware payload", "value": "d7c961dc0a4bfc94e1caf38362c72667ed05b3cc", "object_relation": "sha1", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846685, "uuid": "0c838990-bd51-4982-b396-a1e7f4c40c3e", "comment": "Malware payload", "value": "847e931397e03dae35c4bf1d2510864574fec98be4a86344e15f27ba938fcbada082bb41dc34025afef871bed650e317", "object_relation": "sha3-384", "Tag": [ { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846685, "uuid": "3a91500f-0b6b-40d5-abbd-6ebb0b1f3bf2", "value": "T1BB71425A9C0558986DB373768EBFB48CE8A212774512CB44394CF0C21FB42258B6EFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846685, "uuid": "ccf5ec2d-a290-4991-a988-1a558d79cbde", "value": "48:chSDiD8oNS4Gvd7RpJFtDFeIzTbUdP0rHytOmucEBZ5vZucEh1/YPxpC46:QSzoMvFXbMP0rH8ucANucW1gPt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846685, "uuid": "acc937ea-14f9-4e89-82f4-8e6982dbdaaa", "value": 3618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846685, "uuid": "29945156-3309-458c-a095-ef39f6d3f5ed", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846685, "uuid": "c31001bf-c552-46eb-8d25-1790f8ddf528", "value": "6de3b941749cbeaea1d1324016493bc40cf29b357c400857de958c11333d1030.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33833bd2-feea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894228, "uuid": "6b97a9b1-e632-4cf8-8afe-199d01c615fe", "comment": "Malware payload (Mirai)", "value": "418a8edb3a53cf727bbddeacfd9e1de3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894228, "uuid": "de30d3df-f06f-4ea8-8635-fd9feed87240", "comment": "Malware payload (Mirai)", "value": "6e950129f1e09bcc5d7299effc0a15850b6c6b778e01874d604cca7ef2ed0143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894228, "uuid": "3fa59101-f43c-41c9-b523-118d59909ac5", "comment": "Malware payload (Mirai)", "value": "5de3414ff139f81849ec3a00e93846bdf1b2af03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894228, "uuid": "624c34e4-546c-4a8b-b3c1-3dfc4f5b6fc9", "comment": "Malware payload (Mirai)", "value": "8f37b3403077e367a0124563901979dc1cbc06678b53676caa82053050eb187c5e803fdac6bbf9cd5f4280b4d49bf618", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894228, "uuid": "2c79f8e4-fa57-4ddd-8857-a15220bb43f3", "value": "T14F03F19927149EE3C2063477FBAC88C1959A1FFCC3A738626F1D5AA0579204754FEF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894228, "uuid": "832edeae-6654-411d-aecb-1e5e6024c5df", "value": "768:cjzI1rJYzs4TPDIZzcSCjV5LUtK0j3aCOj/Rk99q3UELvA:c1TmCjV5LUnj3aJj//LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894228, "uuid": "babcb224-202f-4402-aeef-cddc11d17643", "value": 40859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894228, "uuid": "53815aa9-ca3c-40d1-9af4-13f395e074aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894228, "uuid": "509d087e-7670-4f94-adad-dfd031651fe8", "value": "ssh-agent-auth.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc4f49d-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877198, "uuid": "b5420fba-60a2-4e71-9be2-bf06a6d5baba", "comment": "Malware payload (Mirai)", "value": "4d1ddc4b586d475381d2c902c24f42bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877198, "uuid": "c13a7742-4bdf-4cd3-9b73-7062cfe5fed9", "comment": "Malware payload (Mirai)", "value": "6f915eb2f374796bc0e2206f07e25df268b8a24387f2167b4a61539ba89f38ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877198, "uuid": "7215ae2f-6447-458e-86ce-ff69b6591077", "comment": "Malware payload (Mirai)", "value": "f1c8dfa7da213d6b1434b8e531405677cc604242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877198, "uuid": "172f658d-e0b6-4ac8-b4cf-996274a51c9a", "comment": "Malware payload (Mirai)", "value": "c4a35d614b2d4d6904b07985dd07b4437a5ecf26bc414e3551f87c649406378a95c8a1d83dc34ddec555a78dd426b5d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877198, "uuid": "585f8106-6b93-4570-af1e-d647a3f06e47", "value": "T16F932B8F88E14DF6C094F472A8B76965072E69525B0F29D3A87C17510A8F2CF391FB1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877198, "uuid": "5f6d9ba7-bdc5-4d81-9f2f-3a26f50fdaea", "value": "1536:FLCarOTf47u16wg34BulY4M7enaVN/eyhJyGW4qWXpRv0aA7:FLCuOzfe4MKyna3meJyGW4XXQaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877198, "uuid": "5260213d-96d5-4133-8594-3db97553c87e", "value": 95248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877198, "uuid": "fa551b73-c753-424f-b922-768cb7c8a7ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877198, "uuid": "60aaeed3-5353-4ce1-a71d-71c27639c72b", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9bb400-feab-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1769867294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769867294, "uuid": "6e454f54-2336-4182-94ec-0d8bf145cffa", "comment": "Malware payload (DarkVisionRAT)", "value": "2d76c960ac7c7af2bc4a50af7da4b0ba", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769867294, "uuid": "cc839d39-f2aa-4ea8-856b-e364bde99a6f", "comment": "Malware payload (DarkVisionRAT)", "value": "70aacb6ae4c62d3913af232c5f67f17f532c8379adfa0d1ab0185620fb62627f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769867294, "uuid": "bc511d2d-1692-41c6-8566-14c6ab3552bf", "comment": "Malware payload (DarkVisionRAT)", "value": "3970186bd1c9bdbfae46cde28f52574f6e9fe200", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769867294, "uuid": "6c4d2dcc-3032-4fae-954e-72969ba98f21", "comment": "Malware payload (DarkVisionRAT)", "value": "f62594f716c4d252facc376854069284f5ca6f1ee3b01689fe4c0ecb3b868d793fa32e93b330b7c8ea9670610c3a0beb", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769867294, "uuid": "6f34a7b7-6d75-49a0-a7b5-5ea1bbb7aef6", "value": "T1DEB523E269F148BDCC19DE7182D3872DBE9B7B53D8945D0123896A042F6B7062F73B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769867294, "uuid": "bac7066c-2b43-45c6-8fa3-67334b4a7dbd", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769867294, "uuid": "aeaf9358-db78-4c61-bd73-80315db75702", "value": "49152:H029jgaJ27V9Ueg8w73UUUqu370Bwfzxym7xGKoNcm3izbPRelIoQ:UagZ8EhquLfzxhJoNcm3iHLoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769867294, "uuid": "bb3aa003-f21c-433b-8ffb-b1fce0abf621", "value": 2324704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769867294, "uuid": "54525e68-9f5d-423a-8ac5-6485dc92f820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769867294, "uuid": "8052b81b-8bb8-4171-8840-45bad33a4519", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1871b7-fe87-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769851988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769851988, "uuid": "f1bc87c2-a7c8-4c40-b57c-7d73836195dd", "comment": "Malware payload (Mirai)", "value": "5ff2b85fb0107400233c3347c158dcfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769851988, "uuid": "c0157860-f8fa-49b8-8a60-1e2059b851a2", "comment": "Malware payload (Mirai)", "value": "7108e236b155c2cb4ed550b14e4406011bc845aedeb4e57e055834c5f150f7e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769851988, "uuid": "4bb5445c-1519-4ee1-b652-e5b8b9ccdc90", "comment": "Malware payload (Mirai)", "value": "50361b8a02035a5a3be9e22e707944bfbaf703a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769851988, "uuid": "de0d3494-b814-4519-8125-5e4358bfef00", "comment": "Malware payload (Mirai)", "value": "88225b1fe508701178b9dc9f16dbef907940421073ae402430d0cdb5e9ccd86a5a349d31e5fc3c772aa29148fb3eaeac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769851988, "uuid": "1013a11a-b69b-4fc3-95bf-9fe7d4f2d33e", "value": "T171F46C06F70C4573D9631EF02E7F03E6C329595304F9D51A260EA7A61636E3E9AD338A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769851988, "uuid": "e7fb2404-b990-44b7-b592-933a17884b4c", "value": "12288:bnRY4iLH2R8EbhHHflSI8ubLv9VidoXZkkTDIuipCzIHobUI/5rGvS:v9tflsulhnIiqooIBrGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769851988, "uuid": "69528eca-62b7-46d5-9d97-03bd9e968131", "value": 792192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769851988, "uuid": "8a9aedea-02d8-4dfb-91a1-e911d1f16dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769851988, "uuid": "c6c7aabb-6da1-417d-bd6f-375c53ed67a5", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47468e7-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877667, "uuid": "8ba53f0a-5e1a-4fe1-980c-91b1034ca630", "comment": "Malware payload (Mirai)", "value": "5138e0380c5f3d5cafa34e613cb64dfd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877667, "uuid": "07bfc106-e7ef-43b2-a6d9-00bff5a729fa", "comment": "Malware payload (Mirai)", "value": "71a0aa26ecf371a881b316901016c971637dbd4c2cd9fb84c2bece9a1caf30d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877667, "uuid": "1105ec39-ffd2-46ec-afcf-dfd133e7a37e", "comment": "Malware payload (Mirai)", "value": "6954edbc3450ddddf495b3352d1049cd9c4c2563", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877667, "uuid": "e4754017-2b31-4653-a263-1a6f0f4c45f8", "comment": "Malware payload (Mirai)", "value": "9053ba817b98fc7cbb04120c019ef3a7d0f237bea96c12f644fc9ae039665368f4085733782641a2db0e340b876eca66", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877667, "uuid": "3f6c7fbc-47c7-46ee-a6d7-ca434a81fede", "value": "T1EE6117FD42A0BF93CCC5A54CBA1482E1B34B51F5FD72F63C9C684BAA0441B15748BAB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877667, "uuid": "edcae9f4-4188-4f49-8e40-d28344db54de", "value": "96:g64Ko41YZMGeESwo6hMBmzqzI8W+kW864eEmSW:Is9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877667, "uuid": "9cf78b53-7689-417c-a293-4b5a70b067a4", "value": 3181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877667, "uuid": "4566d9be-12f2-4b52-8bba-f89c7a23c79f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877667, "uuid": "fad0e60a-df52-4dcb-ac75-6d35df292e3b", "value": "mao_http.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210185ee-fe85-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850818, "uuid": "45fb403d-053d-4eae-ae64-790403b42134", "comment": "Malware payload (XillenStealer)", "value": "3c0848b32a51c3d1e13a8f61fb8ee8e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850818, "uuid": "64f82535-e4f3-490a-983e-44c9aa5ab6dc", "comment": "Malware payload (XillenStealer)", "value": "72122ae93cedfb91e46dda053604b88bc9013600a46f7857053ddd8a20821310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850818, "uuid": "f321409a-1c69-4026-95f0-826d6f553e83", "comment": "Malware payload (XillenStealer)", "value": "97001c69ad2edbcec2925258fe6c81556c7f959a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850818, "uuid": "45618115-cba8-4477-9bee-08997d2fab18", "comment": "Malware payload (XillenStealer)", "value": "775f02f0b1598d7b91cd6c6d1cf8ed0acfd893d2bc69fa97e390827066b989dcf3c4a8198f996c15789dd84b06b0ba08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850818, "uuid": "7b3af677-ae54-4093-882c-65678fc92b74", "value": "T156F59E17E75244EDC1AAC174C71F9232BA20F85A46317ABF3B58CF192F16F604A6DB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850818, "uuid": "a82e0a6d-23d7-4cca-b09e-4187b3d50c3e", "value": "ceca38aaf88246327be57ca0f6e1d1b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850818, "uuid": "bd4ed2d4-c941-460b-8b1e-b619a0629356", "value": "49152:EuNVxWZ24xPHOv+LKKaaKKCVeimy52AkgIv1vD+fOTRomvEd6:E9ln39Tuk26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850818, "uuid": "d13cc7eb-c96e-435d-bfd4-3d7a7362ac23", "value": 3508024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850818, "uuid": "a62ff282-86ff-4868-95f9-d031f48b3d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850818, "uuid": "2fc19c82-86c0-4324-a795-b3b21c7fafb8", "value": "testpanel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59ff687-fe8d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769854503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769854503, "uuid": "2f6f7cc9-2a93-4ba7-8265-ce85152d1ff6", "comment": "Malware payload (Mirai)", "value": "e203b19f035e236a28d76da13db83a59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769854503, "uuid": "9beb5aab-88a1-4041-997f-bccb555f9a41", "comment": "Malware payload (Mirai)", "value": "73b47a2f08e1a5e98ad250d5f79cb9705ad35ee756cdfec7276085532e2c23fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769854503, "uuid": "384a4a46-c862-4244-b7d5-2fb6593e3c7d", "comment": "Malware payload (Mirai)", "value": "1816c87b21ca64b1c9885b58673ae9a4d36f69f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769854503, "uuid": "cab5f31b-e6d0-4958-bc52-e6655fe7e4a0", "comment": "Malware payload (Mirai)", "value": "815c46573fa3fb373196de016c150d0033715e9c2eb45008d0843ee0afdb2293f3a733d2d7f606b381edf4473f020473", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769854503, "uuid": "12b96cff-22ed-456c-8253-61bf3c88e49b", "value": "T1DDC44A55F8809F61CAC52976F79D829C33174B79C3EB720699144B383BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769854503, "uuid": "4cf7ed2c-c535-4404-b2a7-72c1d3c02fe8", "value": "6144:As3tXB3BdluZ3818uS0XdKkqQigK8O8InBBCZRH9fp63wGCRAwxzBbu4kNgpuors:Z9x3BdWYS0X0BNoHafC7zTkNgpuor12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769854503, "uuid": "f87ae988-7f51-4821-99c0-169119794dd7", "value": 566592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769854503, "uuid": "9b23d012-0d50-467d-9257-f71929d5f035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769854503, "uuid": "3d1dce10-f00d-4c31-a00b-032adeb90d9c", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ef56bc-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876863, "uuid": "279d5b74-17e0-4b07-9ca5-23e4d8e76752", "comment": "Malware payload (Mirai)", "value": "11b10acca7065dd4f11aa5b59d589753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876863, "uuid": "a2855a07-174d-406b-9fda-171537e7c687", "comment": "Malware payload (Mirai)", "value": "73f5c177a94f7ab29d11bdb1562bc7e7d8285866e55abd8c5f3488118880bc37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876863, "uuid": "faea3919-0f80-4e92-b183-373982501165", "comment": "Malware payload (Mirai)", "value": "4e5924c8cfa391269db448d1547cb52668307834", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876863, "uuid": "211262c0-4025-4ef4-a54e-127b2e208b8c", "comment": "Malware payload (Mirai)", "value": "f9ac81707d5f0f9cda8496ca61e8121123f000a452ca6f11b769a71601cd4fa987790cb301463bc943fd27dcdc5d0fe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876863, "uuid": "00fba46e-048d-4445-94e4-93cceb5ae2dd", "value": "T1A1C309D2BB43CAB7DC4311F111F7AB324E32F87A1836D982E378BDA199516C0661676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876863, "uuid": "518f4414-dc30-4b39-a99e-4b40daa4b5d2", "value": "3072:Oxtoh9DISPQ79+Rc44qXAPMLcfbzhqfmhAB1kD:6+9cSo79+RcDZqfED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876863, "uuid": "31d65164-fadc-463e-9538-810ba9c97cb8", "value": 124164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876863, "uuid": "d9d0d0e9-1479-409b-be46-0b1363d66b65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876863, "uuid": "1df881e3-38b6-48ce-9f16-74c97f363a90", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94fe4b4-fea8-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769866160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866160, "uuid": "1e45df25-0191-48b0-b43b-44663906e54f", "comment": "Malware payload (SalatStealer)", "value": "ca6e3441c33e306038adfa627112f901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866160, "uuid": "96e1c9b0-8af3-4bf4-a03a-e0e4e13e4932", "comment": "Malware payload (SalatStealer)", "value": "74dafa33b566bce5c47eddf84e43718444f6ac55c96941da1824a05c799d5911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866160, "uuid": "32f911cc-8235-447a-a1e7-afb9d01a62d5", "comment": "Malware payload (SalatStealer)", "value": "e8573f3356b9a39126e26731cd278eef6a4f4d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866160, "uuid": "927019f3-cc67-4db4-84eb-ff76b39a83ab", "comment": "Malware payload (SalatStealer)", "value": "41cf8def3c1b196fc544e99ed468c445e663854deba118aad1c46f790989afcc257f83468424940b187fcd4135c3eb91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866160, "uuid": "ad0c80ff-8888-410e-a914-44d0a2a30f37", "value": "T1C2E533CFAF0A6C59FFB6A07481CDB20CD48B894231E4D3247614C7297A969C4A5DEB7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866160, "uuid": "5a6230fd-9a0e-4884-a110-7e5821d8d829", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866160, "uuid": "959985b1-0849-4d3a-8ec7-5bccf76904e8", "value": "98304:0yoiQxJSXJMwzqyvRJ76VKkzFHsCDIBaVf:shKf3kzFMCDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769866160, "uuid": "c9f4f54b-faae-49fb-8bec-c3b30bacf2dc", "value": 3243520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769866160, "uuid": "cf0c4fea-4ed5-432d-9691-38386f35d050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866160, "uuid": "7075ba10-e435-4025-ac9c-3d4b0df93602", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.27940.12005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9953566-fece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769882481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882481, "uuid": "fc1cc024-dd34-4b09-bdc3-b293f992660b", "comment": "Malware payload (Mirai)", "value": "4535276cc6d45e60259fc906e297cc27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882481, "uuid": "8ee29897-8aa4-41c6-aae1-2c5d4b2bdd51", "comment": "Malware payload (Mirai)", "value": "7592909802f29e0d3a62b4bbeac64ee5bcff55c02461d75a5d0f947320d1f6cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882481, "uuid": "9aabca66-f038-4a7d-ba7a-4649ff76ee81", "comment": "Malware payload (Mirai)", "value": "185c8fef86a4076266b74318224dcfab3e1af8b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882481, "uuid": "4f1e07bf-e52f-4583-be67-56a5789f41cb", "comment": "Malware payload (Mirai)", "value": "94c8e539eb6e0ae84ee7941f3da7607cc363c9f4aaf1ff48b0deb23cf3bf00d033125aaedb5d9fc77f60f57147f1a4ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882481, "uuid": "eb570b9f-469d-4b92-9f09-7656c039269a", "value": "T15CE3BF97B7475050C8E50BF84BCB5BAC292B21019E6B84F77D2E363A19775CB580B3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882481, "uuid": "b4cf8b8c-cb64-4a6f-b271-2deda9b15479", "value": "3072:XeYGWAYoQk7L3kcCW0leqqfn4ege7JagXCZvCA+Sq:XpGWAr/kM0P4n7VCZvCmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769882481, "uuid": "d1c2b28f-2521-4800-9698-68d233748d85", "value": 157140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769882481, "uuid": "8bb707db-491f-4cfe-a3ed-cc27ffdd2168", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882481, "uuid": "b87ecf69-9f6f-4534-b055-e86438de7cde", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36928ab-feff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769903570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903570, "uuid": "a13fa558-2fcf-4fcf-9a07-24b8fdd22838", "comment": "Malware payload", "value": "2bd7774fa9ad56924d2aa0497e9ce05d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903570, "uuid": "7fb48314-9b5a-4560-82f5-bfe0a265c1e5", "comment": "Malware payload", "value": "7798165f2a3542ed381179e299c7b909af9c7cfd4d7c272ef30e5ddf62ecc867", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903570, "uuid": "76fe6aef-745e-4766-bbf0-e188644446fc", "comment": "Malware payload", "value": "b8a298c1d3422089afbe4295708013b6744acbb9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903570, "uuid": "f859989a-3713-4080-9080-3fdd9bfeeb49", "comment": "Malware payload", "value": "ba290067de014aa08d9f9d3b4e6112fd16828c2de72c782169b1854b2ebaad147a1145e57cc314ba852e04cea83f32da", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903570, "uuid": "06b5b8fb-f26e-4ea1-9f56-a65b693748ae", "value": "T103E53379770B7499F82459BED8AA13C22329BF26F57101ED24E46B7C79B60B9C20077C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903570, "uuid": "e19750b0-5cc6-43e3-ab57-f25d0e7f997b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903570, "uuid": "c03ba9f2-1a76-4c1e-a656-b7050fcdd39e", "value": "49152:GiSHEXxng31v8Q0td5DopbQ/mdgwExx/LFenHXwi/qjnWaPswdFXcP4owRk7L0m7:BSwx21vRc5VHxe3lgWaTTXcgowGn0MsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769903570, "uuid": "dc9931b9-6fb1-4709-a6e8-5f7b21d98396", "value": 3084288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769903570, "uuid": "eeba080b-8f0b-4257-bad7-40e14185ab82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903570, "uuid": "75db8557-e1fc-4ebb-b97a-5cfbded1f16b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2eaa8f5-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877772, "uuid": "39a4d39e-3283-4035-8219-8df2c307ac94", "comment": "Malware payload (Mirai)", "value": "2dee7f541425e2ac359197153b38ede8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877772, "uuid": "d44a3de4-96ba-4e41-b744-5b89b12db3c6", "comment": "Malware payload (Mirai)", "value": "77e020fefb70aaca3863a0041041cf9a597465ab1d357b07ad015876fbf23fab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877772, "uuid": "c61519f7-e9a6-48da-b8c0-619bfc90f744", "comment": "Malware payload (Mirai)", "value": "8818836ac8e899b8de1eda1c50ab54d7d0cc7514", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877772, "uuid": "5fc6fbfe-4c00-411d-a4f9-b4e5d1830046", "comment": "Malware payload (Mirai)", "value": "df8aa05e73eb3ac046c87d7f5e19e8138730e5549cc1dfaddca66e817bbfcc3f191c59d285ff7ee917c29805b4aa6e66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877772, "uuid": "cb038315-6378-4954-8093-9ed2a4899c57", "value": "T142438E37C5AA1DE0C6448574B628CFF40B63A504A696BFF686428E21444BFFCF2067F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877772, "uuid": "7540c1a3-03c0-453d-ab08-0296983fc0ee", "value": "768:x/AgKMnXQvqbatZ8me+2zS2DO2HDFNbkJyqYtChoooenaxCSzIFn79:x/hXZbatNzWJkBYtRoxaxCSMF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877772, "uuid": "3cde649b-d683-42f7-9320-91eb43caf250", "value": 59160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877772, "uuid": "8833f358-c5ca-467b-9fa5-5145991e0ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877772, "uuid": "c97837ae-c572-4202-8838-3dc6108112fe", "value": "mao.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aa0bc3-fea8-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769866180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866180, "uuid": "a4c51293-5700-455d-822a-872a94e74aad", "comment": "Malware payload (SalatStealer)", "value": "9db3ccab1fb84d5a92c761462fa2ffb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866180, "uuid": "e089db2f-a1b9-4fcc-a8ea-e813071b4177", "comment": "Malware payload (SalatStealer)", "value": "7c3f488c63c3d29166dcc56d1d6a1fad304933b6c463c660e010cb3825046335", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866180, "uuid": "5157c30a-d784-47aa-be90-052874a23939", "comment": "Malware payload (SalatStealer)", "value": "c696b3a04c31ab28441e50cc7b4b95cdcf47a053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866180, "uuid": "0c6870b2-fa0e-4263-95b8-b2391e86d49d", "comment": "Malware payload (SalatStealer)", "value": "f3e4504eb57c3ebdf7ca7720fb36d364ac3c4455b71686d962b448c2afc02430726b27ff70fe1cbad2d28bef9b84403d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866180, "uuid": "147d0d19-bdc0-4d92-abbf-eabe08003d98", "value": "T119B66B81FA8B95F6E9031831516BB27F23345D048B28DBD7EB543E6BFC77A911C26209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866180, "uuid": "cb148453-b10e-4c6a-b73f-a511d862db82", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866180, "uuid": "a95a95cb-d53e-421c-a765-b02d267ee5d9", "value": "49152:mkMy8xa9ILH0q1qtZ6NGFWBytCaFUXoyr2PvlaFQdA1GNo/j/QDbN4rbq575GzXM:AZxa9wqXPF9tHp/yjoGrCP9WMSEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769866180, "uuid": "a81332ef-db44-4860-8daa-b8a521339a85", "value": 11405312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769866180, "uuid": "14037249-4b2c-4c64-8ed8-7d8cf3d10cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866180, "uuid": "1d403613-911f-446c-a548-bb66607e7b69", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.27940.12005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38c3b8b-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877666, "uuid": "1bbe6edc-17ef-4d43-acd1-f8066aaf797f", "comment": "Malware payload (Mirai)", "value": "11fd667f8de1d6afe9f5288e216a3e36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877666, "uuid": "e91fdac0-8c08-4128-9dbd-f684f7167675", "comment": "Malware payload (Mirai)", "value": "7ca1830b7217d38b4b596f0146c8a5f0107c5ec4ca25f1e3e8f37bc8103ba2d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877666, "uuid": "1676ee69-6810-4448-b35f-6696d00b8d4b", "comment": "Malware payload (Mirai)", "value": "9847409244157e856426250c476d6a65cb5ef348", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877666, "uuid": "d5d1322a-418c-4c3f-ae2a-3943171f141e", "comment": "Malware payload (Mirai)", "value": "d4a079478ce7aea2befe629744bebac9a2698eb3ee00d5853221854dab9c69fcb7ac4ba9014877795ed76840cebc7439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877666, "uuid": "aadfbbb6-8057-4945-a49c-ece45a6fa80a", "value": "T15D535B8AE78BD5F0DD4609B0207BFB39DA35A8313234DEB3DBC4B957EDA2542909125C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877666, "uuid": "cd13361f-a83e-4874-90ae-3d6997046dfd", "value": "768:YwE465jMEOf7Tat06hhGeCUf9GRW8StPDg6ZVZD5y7DLqxQZVlSITjK2Hen1Nqru:YwKIEOf7u0wGeCUf9GA8QbIlSI5yNqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877666, "uuid": "aec50fef-d4f8-4756-b2a9-5cddba93a9a2", "value": 66276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877666, "uuid": "d901025e-bb42-4db5-b7b9-0eb91e320ffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877666, "uuid": "257660ee-ad39-4124-8a41-b93062393553", "value": "mao.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da28721d-fea8-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769866161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866161, "uuid": "4308d199-ea87-480d-a2b8-658b8853e853", "comment": "Malware payload (SalatStealer)", "value": "9050fe36280d3fd80e183403d419b8f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866161, "uuid": "813d4a30-5e7a-4ba6-a772-3ac966f180cf", "comment": "Malware payload (SalatStealer)", "value": "7da382f87aeccf21dd8c656174fdcb66813c6c79305beebffad863eb2159c9b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866161, "uuid": "0596d1f0-3cee-40d6-a03f-86f270d0ed2f", "comment": "Malware payload (SalatStealer)", "value": "d8563460bd03d6a0213a23f98f1d5100323d3246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866161, "uuid": "6b57405e-9938-48a8-aad6-1b4e0fe0d908", "comment": "Malware payload (SalatStealer)", "value": "9636204abef556bec03b2bd02d1ff05e94784ee93f8f2204f6c1ba622fd1cc0ec0a082e7e8189196fda5c2a0a32016dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866161, "uuid": "9af38226-18ec-477f-91ce-216d64476aab", "value": "T155E533BA6E009C9FD5ACEC311D102346B486926E092C76479AE473C7C62B9EDF3F6C51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866161, "uuid": "3ea85ddd-a66c-4f20-ad28-09bd03948939", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866161, "uuid": "48d5be86-7b68-4b4e-a3b4-551a305b7e54", "value": "98304:oAITSa02G+Lc2GdC/8eaVwTNt9mVzIlBSCNxJzOe:oFzRA2Gdo8TwTRmV0lBhJ6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769866161, "uuid": "bf249f67-3fea-4248-b62b-c172734916d1", "value": 3243520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769866161, "uuid": "96a0b8b0-ff6f-40ab-891a-1b4bbcc851e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866161, "uuid": "40e832dc-466a-46d0-b94b-50e9df949b92", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.28485.23761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ab0222-fe84-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850455, "uuid": "f5c46a7a-775f-4720-aa7e-89b3ab9d2237", "comment": "Malware payload (XillenStealer)", "value": "8fbedfe9b2ad7d270af105b41e4cf5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850455, "uuid": "815dc316-c67f-4650-bc2b-74682b380bc8", "comment": "Malware payload (XillenStealer)", "value": "7f203543c642de5fdc6d9582068c5ba272309017fa4b6911e523365894284fe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850455, "uuid": "0113d2e9-aa31-4798-934d-88b0d4facee1", "comment": "Malware payload (XillenStealer)", "value": "a7c2f31b41544c2035381cc0a3dfc3fe097426b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850455, "uuid": "5e121710-1749-47a8-9321-4d0dd689ee31", "comment": "Malware payload (XillenStealer)", "value": "ab39c879b5a968708a8bf9f9ab5274adb09bb8c359e79e16f89fff1648ad2c85ff8a9fe3b8d1657b05efbb4b352a2663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850455, "uuid": "644750b0-4083-4911-a4cb-f75d0285390b", "value": "T1A0F59E17E66244EEC1A7C175861F9233BA30F85A16317A7F2B58CF292F16F604A6DF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850455, "uuid": "9cb03550-4531-4bc3-b0d1-c71e88aafc88", "value": "ceca38aaf88246327be57ca0f6e1d1b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850455, "uuid": "f7e510a9-a927-42c0-b58d-abfd6873b763", "value": "49152:d6dkVHIzzWupGzKevKLLKKaaKKW7cbBYnM52AkgIv1vD+fOTRomvEdD:dzIw2BIXn39Tuk2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850455, "uuid": "92b6935a-fe51-4fb7-af81-71d344bfb38f", "value": 3520568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850455, "uuid": "8b6ece5f-c6eb-440c-ae6d-023cfc26f467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850455, "uuid": "cdb98c9c-72c4-4069-bc23-5e76d6449350", "value": "7f203543c642de5fdc6d9582068c5ba272309017fa4b6911e523365894284fe5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7213f897-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769861262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861262, "uuid": "c4790973-6a68-451c-a059-3263ee923a60", "comment": "Malware payload (Vidar)", "value": "304d1b953233ff6e0c9781b54bc84c73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861262, "uuid": "659d19b4-9dac-43a2-92c2-e7feb6166c3f", "comment": "Malware payload (Vidar)", "value": "7fc31b4326e89cb3ed0857f5090d221d7781a8124e230f43dbb0f3aec39fb9c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861262, "uuid": "fa4495d3-2eb7-42c9-a8ca-1c17378e43d6", "comment": "Malware payload (Vidar)", "value": "44393833432ea503f299f3aeac729c9b38f24385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861262, "uuid": "ef38ed2e-827e-4852-ae5f-efd09f09a5ac", "comment": "Malware payload (Vidar)", "value": "ebf332887b5b78df19f8be179373ff40894eb2c5f164ae25e7a46a5bd3d94c8b7d551478e30d6ae7dbac02f6f8fb751e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861262, "uuid": "518b7876-14fb-463c-8539-3400c8d1d615", "value": "T106A4187E9C60E376F50DD0BAE285D3625E2178410125EFB328E9E7200589572EB1B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861262, "uuid": "36d37b4c-d2bb-4e1e-ab80-ded21614c857", "value": "1e377d8de82679ecce8fc97b181c89e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861262, "uuid": "82455255-520d-4dcb-a52a-2ff6a36e2aca", "value": "12288:OEDpyhao0xX+I5sOrJ3jHEm4Vb+2yjJ9:OENyhV05TF1Am4VbcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861262, "uuid": "ecd95846-6b46-4ab1-8d7c-40904b84adf0", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861262, "uuid": "f52270bb-e96f-4ea2-bc26-1e929a0b83b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861262, "uuid": "7fe03fe5-4754-419a-afa7-a4f761c47578", "value": "eNLe4nm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1856082e-fe85-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769850804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850804, "uuid": "56861fcf-3ce6-4f27-8683-a79778c3ca3a", "comment": "Malware payload (Mirai)", "value": "25bcccd84eff9ef37d4b637910bbedb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850804, "uuid": "00431cd1-8547-455a-9082-8fd47c87c121", "comment": "Malware payload (Mirai)", "value": "7ff5b9d2f65ed4656df012c0111c477f91c1ca9bc89b98187a84f5b106498c3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850804, "uuid": "739d7a8a-9b5e-41f3-b4b3-415eb0fcbcc7", "comment": "Malware payload (Mirai)", "value": "8031ad92f50c0de04becd7eaf6c01c93fc769ccc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850804, "uuid": "313cc180-acf5-4a83-a33d-bc84c5c9fc68", "comment": "Malware payload (Mirai)", "value": "7db03749a6d6bb30d0a0acfe93f6a20030ac9fb903b79d671b5af9fb526d86a0f9f7f81bf4211a0b8802977c691e8946", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850804, "uuid": "b42a6004-c728-40e1-a23a-c5744d46a17b", "value": "T129A32B46F952CA03C6C211BAFB9F814D37126BB8D2F63212DD247FA127874DA0D7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850804, "uuid": "41457e29-10eb-4204-8457-84ec11c3b6cc", "value": "3072:Y7aEU8xL1l2C37GtvcNgjN+FeJ5xqvB1tJmutC/:Y2EFxL1l2CavfBDzxqp1tJnc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850804, "uuid": "0ba4ea66-ffa1-4e74-8246-849bd6841b27", "value": 102288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850804, "uuid": "fb7276cd-e95e-4f61-9190-110e83bb7b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850804, "uuid": "ed965cf2-9b1c-422d-b186-d24572b09b8e", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a476d9-fec4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769877889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877889, "uuid": "ff698d3f-ced5-416a-80b5-93a69fc3b432", "comment": "Malware payload", "value": "ddf98a217c0d6bac2f9a9a8941f2a478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877889, "uuid": "dd698ee8-10bb-4764-95b2-6da6530562a2", "comment": "Malware payload", "value": "80aadc05d11cfe7412a7fe549ae92ffe1865525f6e8e69a5d56ef335d0d4e361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877889, "uuid": "9de3166e-2b9e-43ee-8479-5538255ddaa9", "comment": "Malware payload", "value": "a5edd43bf48d48143e3ecaa09a65c9dd6d77c4e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877889, "uuid": "19675ac9-de0a-4304-a54e-2eab3dc76a42", "comment": "Malware payload", "value": "687b06c55133388201d11f8b97e3e8c4b4de4154e6bc99642c30f81e100e047b3f5b306341786915e3fe56fb9addc0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877889, "uuid": "d33b3db2-6877-40e8-a2a0-8336d05bb83d", "value": "T17BF5F113B2CBA03EE45D0B3B0572E17894FB6E556523AD168AE48C9FFF250601E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877889, "uuid": "1ed4c49c-d608-48fb-9d5d-ecd90b9c40d5", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877889, "uuid": "ff75a16a-20ca-40c4-810d-cbfa47e8686f", "value": "49152:1+MRdOHlNrOToziVHPPNLxeJLBZ9FMXX2Sa55NLuQdOibFJfZmgTxo+a7y7:1ryrziVtLSFZRSmaQdNJRTam7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877889, "uuid": "6b1d3ae2-1039-4c84-a27d-367bc61c6499", "value": 3385715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877889, "uuid": "97301dc1-f22c-4ecd-a292-9d4fe02e9b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877889, "uuid": "b896bfaf-2f89-4df4-8c9e-df48d4c4ee22", "value": "ddf98a217c0d6bac2f9a9a8941f2a478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a515c0-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877773, "uuid": "a04311ad-cc0c-4dc9-92d3-8fb41e1a2141", "comment": "Malware payload (Mirai)", "value": "e106a050f05085b99951e94866d82a4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877773, "uuid": "d04dc9bc-4b21-4de6-bac4-94baa8a63f2b", "comment": "Malware payload (Mirai)", "value": "80e2ffefac43ba12de92a71d3fb462576c6e13618faf4b1162198410a0f8f953", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877773, "uuid": "77c32f5a-762f-49ca-b453-0c2f1fdc5e7d", "comment": "Malware payload (Mirai)", "value": "babf24398bb3051b315872712a40ce220dc2ae7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877773, "uuid": "6c8871c8-ff47-4199-9337-795d6e7b406a", "comment": "Malware payload (Mirai)", "value": "ad3c84fac1cb44e9ad2abaeb74c18d3f6756799862eb6fee78ed151452b1e10b139142e9e599d5936309081d1ec38751", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877773, "uuid": "92ce8b32-23e6-4689-9179-912d06f3bcaa", "value": "T198531947B94081FDC199C13943B7B67AC52731BE123CB2DB6BD4FE2B5C42EA11A1D889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877773, "uuid": "4e21da82-50a1-4718-8cfe-4a500d77acf0", "value": "1536:gYo4Y8d1+u1iIIxniAGsKz97biG/YhJuaibdjAVb:n7P+u4IIxniXiG/YhZibd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877773, "uuid": "2f7ca61e-8cb9-492a-9c68-5ca5771e28a3", "value": 65376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877773, "uuid": "6d7c79d0-a884-4eb5-b2ef-1ffa98c8e34c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877773, "uuid": "927243a7-9f67-49c1-bbeb-d92d3d1c0382", "value": "mao.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9053c8f8-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877204, "uuid": "f525cb8f-f437-4395-bef5-9e71a9108527", "comment": "Malware payload (Mirai)", "value": "e85a740a2b6338ede60033768c9d9c74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877204, "uuid": "d3ba8991-5839-4812-9bfd-17c82f5b8a31", "comment": "Malware payload (Mirai)", "value": "847148466f680d6180583cb1de4ce9986d809dfe1df75e182fdee72843b77c12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877204, "uuid": "8efc6be7-6b35-4f29-89d9-9c9b387d85f4", "comment": "Malware payload (Mirai)", "value": "929d875ee9d3e7bdae971d4aa716beb144b91b4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877204, "uuid": "fbd73f38-55ff-4c7d-ac86-c622ef52e6f3", "comment": "Malware payload (Mirai)", "value": "5153f211aaf8e065943f3aa05ffe9d79356ee7630ba2fce0678228e84ad2a9bd6c1c447a1a593a73371297ff205c4c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877204, "uuid": "37f548ab-8ba5-4300-9dc1-7f46223bb31b", "value": "T14CD34B85F382C0B2D0430AB01197DB650630EE7B2255DC1FF358AFB6BE35685A166B6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877204, "uuid": "88ec7416-021f-4158-9b6e-e9d8f5e30cc0", "value": "3072:dk/S2hSsmJXOkq7fQ5b54wfL6YtDIuifWN2VJZ1:dk/F+f+054wWYJKWoJZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877204, "uuid": "92f83fb1-d95f-4839-8794-29c3671cbf10", "value": 134798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877204, "uuid": "68d2d6f9-8f33-4e29-9622-b4888a24e374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877204, "uuid": "99bbd36f-1aec-4e60-a105-6593315904f3", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270a0bf4-fed2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769883900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883900, "uuid": "04c27e7e-3cb5-4a81-9f8d-dd6a31bf2811", "comment": "Malware payload (Mirai)", "value": "322ffed6bf3f3111c70c28cc97e15a0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883900, "uuid": "7899cf67-bf13-473b-93b2-7d96412fbb41", "comment": "Malware payload (Mirai)", "value": "848980bb54a77cebe70dbe69da2136f12e9c015c9eec8d18c732b23f28699a54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883900, "uuid": "c73eab35-a333-450d-b68f-7cc0e7927f09", "comment": "Malware payload (Mirai)", "value": "7e8d7c705f5b45cb1da81334b8f77b3f19529782", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883900, "uuid": "b99c108e-ed9f-41da-86f4-b39b8485966f", "comment": "Malware payload (Mirai)", "value": "f5e0f85fbee447a421dcc712476599a63d444041e1b2b4e0433813ee8ea3efab24ab64a8fd1cfe7b967223b7169b34c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769883900, "uuid": "9ec00e93-b44e-4339-a2ec-bcac15d41d64", "value": "T111C44A55F8809FA1CAC52576F75E829C33134B79C3EB720699245B343B9B86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769883900, "uuid": "98aa424b-3c6c-4039-b745-6415873379e7", "value": "12288:XvXV56q6hFg0XE/ahkXj4ILMYt4IMcgpuor6g:vV5Bjahk0oMY6IMZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769883900, "uuid": "066464d2-3c8a-46ef-8b8f-bc3866950a93", "value": 554308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769883900, "uuid": "9c9b370a-47e0-441a-904b-0742998e5671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769883900, "uuid": "bfd0bb64-8e5a-40da-876e-c4c845ac2873", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daba6f62-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769884630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884630, "uuid": "15bab468-28bb-48f9-82e4-db9c31372a3f", "comment": "Malware payload", "value": "05cdcfd0ed8b43bb28a95ff65c055659", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884630, "uuid": "e285cc14-3938-4a5e-b41b-c649a10d3847", "comment": "Malware payload", "value": "848eceff82baba2a3c5b987bb917e7d5e811ec7e54cbcb0850799b187718061b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884630, "uuid": "f0792fe5-6a5b-4de7-b02b-87374cdcd225", "comment": "Malware payload", "value": "38a92876402b2839c690193abb9e730f8d69a9d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884630, "uuid": "c9bea405-6895-49c6-ad3f-f25033fb73a7", "comment": "Malware payload", "value": "40d6614f53a7213c2cabd9dd0933aea8f88668350a82c387073f04248886cf5252e3f2e5a7e0d07b057e9d09daec05c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884630, "uuid": "46cf9d3e-74a3-45a1-acf9-482951652ce2", "value": "T1B1937C85FB47E0F0D91609B011ABF7398631DD371014DD6BEB98FE72AC32652A116BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884630, "uuid": "c9177481-9f3a-4ea1-8641-166f2811ef3d", "value": "1536:CMlzBnWNbgzFuJstApHNgaf/YVJ8GGO7qoQ2m6UL31Q0HLjHqxlr:ZDnibgR+stApHNgafwV266uCOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884630, "uuid": "03172038-a413-4f74-a01b-f86534a3f28b", "value": 95444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884630, "uuid": "0d232b11-b9fc-456f-98ef-5e4c5eeb5bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884630, "uuid": "b0c09c1a-1550-4c96-8bc9-4aae17d91d14", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bc1216-fec4-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1769877997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877997, "uuid": "74cc366f-8cd4-45c8-8ad8-ce6e87045f8e", "comment": "Malware payload (Gh0stRAT)", "value": "3487509b16cb20e049103683452758da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877997, "uuid": "ca54d25d-590a-41cc-a533-59558c21895b", "comment": "Malware payload (Gh0stRAT)", "value": "8507309e3f00c1258d632b4de937dd9540751e56e6276d7226dd6c916456a763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877997, "uuid": "30797828-f01d-4d2b-a0f4-65fd0bda3219", "comment": "Malware payload (Gh0stRAT)", "value": "fc4dcc91a5593d9482c9959f44eb6bd2448901d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877997, "uuid": "82eaf8c4-3164-4c5f-8e90-88a2783382e1", "comment": "Malware payload (Gh0stRAT)", "value": "6b047a358ee283543d19239545f76cc970d836c2aeda1578cb85059fd7b8afd56a1d31fc332f457ff4f9755399ec1061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877997, "uuid": "fc95381a-7542-4adf-ae80-f3c7f5bc2e4d", "value": "T1F4273313A2CF653FF0AF8A354A76E216817B7A516A264C6697F448ACCF0E0D01D3F746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877997, "uuid": "a3adf66e-e67c-4221-b5b3-dca06dffbf96", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877997, "uuid": "163d3423-5237-4cdc-8597-700c1238cbb5", "value": "393216:p0JuuoyGijTUesg32lf+q86YAN437cGpMiZJF292U64VEDOPH:qJ7maUrg32Eq8Oq/S4f8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877997, "uuid": "fe9b3703-01c3-4358-ae8e-296f199ab1c8", "value": 22050398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877997, "uuid": "2b23ee3c-6ccd-4a5b-9ec6-031813817e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877997, "uuid": "90ca827f-c5ba-4ca9-bc02-66f5fdc77833", "value": "VC_radist.x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846a2fdb-fed0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769883197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883197, "uuid": "d9dc55c4-76d9-4e54-a5da-f436dc4e2a07", "comment": "Malware payload (Mirai)", "value": "aa25d43ccad97e87ffc19df00b97c6df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883197, "uuid": "1085e71b-d51f-4c2a-a997-dd2a39fb54bb", "comment": "Malware payload (Mirai)", "value": "8613991e01ffc1d80cca591aa2b1a2eef4a5426666988a46d21f4e9048db13e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883197, "uuid": "15860fa1-c8bd-4d3a-bc86-fa3288b366ee", "comment": "Malware payload (Mirai)", "value": "c06002199f0feb7925b16f828a8d43e048448f7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769883197, "uuid": "a9fe825f-432b-46a0-bd73-f06b593a0b35", "comment": "Malware payload (Mirai)", "value": "b19a82511a61a2b618c5d544339515024c5155285001ed446bd552edb171be49ac1de75f6073875c0b7992a5ffa74b1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769883197, "uuid": "84fece31-bfbd-4e11-931b-62933f876cf9", "value": "T1A0033B278976AB0BC7D4637701D783B1D0FE1B841294171FBD0B4C9DFEA63416A6A38A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769883197, "uuid": "2fcc36b9-050d-4eda-9f73-9c3c98882c66", "value": "384:fKki8/hhfCHTcUyAD9CiSCmxVO1k1Aah26CWPu9KFEbo3gA3db0OKD5I5Bm5ieud:fKefCAjAD0/ne6ueEboPb0bTIe6UKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769883197, "uuid": "33bbb41a-5bf4-4c26-97cb-d28013ea0387", "value": 38628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769883197, "uuid": "3ecd72b2-9ae8-4b2e-8526-80aeccfc8462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769883197, "uuid": "3711fc40-c1b6-43f4-b784-9686d28cfe8a", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2345393a-fe85-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850822, "uuid": "736aab62-6ddf-4fb9-9460-493dacbad4f3", "comment": "Malware payload (XillenStealer)", "value": "927c17e35c7c1262b5cdb077a7888eab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850822, "uuid": "1c2b57e8-237c-4b99-b17c-7509dd7cb33f", "comment": "Malware payload (XillenStealer)", "value": "861b9bce50d31ce29abbd3e3923d78631a94bebad7df408976aeb51296f25627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850822, "uuid": "41abe72d-bf7d-48fd-87b3-6712f67c2c2f", "comment": "Malware payload (XillenStealer)", "value": "0d3a51ed910e1fe24a004a1ac49d07e40b0ccc72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850822, "uuid": "5da80314-9b10-43a8-8873-10c5cc1d5bcc", "comment": "Malware payload (XillenStealer)", "value": "4eb46d61694ac5464b3bb501174c179923c2fc742b76a24c7a89e65956392faed0cde7cc3c1ec2929f3ce4b99e409066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850822, "uuid": "8673772f-2fb6-4758-a5c4-084d1ca83f95", "value": "T174F59E17E76244EEC1AAD175861F9233FA30F85A06317A7F2B58CF192F16F604A6DB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850822, "uuid": "55e05995-4a46-47e3-bf01-89e4f7d23ff8", "value": "ceca38aaf88246327be57ca0f6e1d1b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850822, "uuid": "a7cf1ab6-38b4-4977-9654-5f3d38895529", "value": "49152:6BlkHI9Nn7ptBFtnI+KKaaKKZtEUm+52AkgIv1vD+fOTRomvEdD:6KIBvmtn39Tuk2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850822, "uuid": "65b9f6f9-fbfe-493c-9b91-79dad5e1940e", "value": 3517752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850822, "uuid": "91612fb4-5f4c-4c2c-baf5-10313d8f2dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850822, "uuid": "ae0191dd-87fb-4ea4-805f-100ad4455af3", "value": "LatestTest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38b66da-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884618, "uuid": "8f12bacf-d25c-4157-8a4b-09d38a390ee6", "comment": "Malware payload (Mirai)", "value": "32184044dab91b1c98fe047970c55649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884618, "uuid": "58c9118e-3cfc-45dc-88a1-4691ee36f4d9", "comment": "Malware payload (Mirai)", "value": "86b997df4a5240eaebcd24887f6628123668129f11c230deb3f50736f2e26f5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884618, "uuid": "f177d605-ee61-4b9c-b0f5-9ce0c1e40580", "comment": "Malware payload (Mirai)", "value": "92fbcc9db249bd74d139810cf051ddc555dbd266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884618, "uuid": "224182d1-8117-4b19-af06-5f5e9547f992", "comment": "Malware payload (Mirai)", "value": "8bbfb5a23fe2c6a62301499b989876fbb9f00661a77069b3fddde2f7dfdd7a2980a722766445637bac65b538f465cb08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884618, "uuid": "379f40c3-bc53-460c-9e5b-1a30a6b2c863", "value": "T195633BDAF801DD7DF81BD77A4453090AB530B3D502831B3B63A7B9A7BC721A81E12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884618, "uuid": "0c3db49f-67f9-49e3-839d-d61a46e255b6", "value": "1536:vAgV/fxEhaMDY7Dm8VJyyE1sxQWbxdJ3rWNzE+VQai:vAQ/fOhjE7DiyE1GQSx/B+Vzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884618, "uuid": "3bef7408-1340-43a8-938c-70bbb082b216", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884618, "uuid": "1932f929-d389-4c54-b761-db056335276c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884618, "uuid": "9cea3d70-b670-45c9-8aae-91e760dc8475", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a815dd-fe83-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769849938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849938, "uuid": "22a071c4-56a6-4146-8d63-2f5c077048f1", "comment": "Malware payload (Mirai)", "value": "416440ab479c909f3de3dbde0e1bbde7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849938, "uuid": "8af005f2-7028-46b1-9ba9-ea5ba48610f3", "comment": "Malware payload (Mirai)", "value": "88143d2ef07fbbb40acc0c8daa473beffa4d417ed13afbe52669e1e5d83c7dd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849938, "uuid": "88cf45f7-d762-432c-adf1-7951f33cbdf3", "comment": "Malware payload (Mirai)", "value": "710349b180b392739f6c9b78ce6a0a8fa4e3b18f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849938, "uuid": "3226febf-a457-4210-a460-95b49f88aec0", "comment": "Malware payload (Mirai)", "value": "fa5e19e843c431b555b36afd4af53a91c7186caf745487d386b2d4e2a35f4fe517ad1d208f8827b623e94239ccd14a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849938, "uuid": "7adf5f59-a37e-4c57-b883-40b72c9bdf19", "value": "T10BC45B55F8809FA1CAC5257AF75E829C33134779C3EBB20699145B343B9B86B0F3E642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849938, "uuid": "33ff4e05-ad6b-4160-b9da-10063b71920e", "value": "12288:GDkTAxBexvg0Xtdw53nhA4LL/sIVGgpuortp:NTAXKw536YLkIVH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769849938, "uuid": "ad927707-c1f6-44c0-bd9c-b6fdadd57e87", "value": 554308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769849938, "uuid": "28374ffb-94f8-4898-8d08-b016d3e03b98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849938, "uuid": "dadb928d-55c1-4725-9933-91a189aca998", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cd451b-fee9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894093, "uuid": "74ca7948-39be-45a7-b26e-d71129549ce7", "comment": "Malware payload (Mirai)", "value": "9b2a0b0a810823e867bd96b3e8fefb26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894093, "uuid": "c339c7b0-b032-430c-ba89-b45f07b4251e", "comment": "Malware payload (Mirai)", "value": "882127ddf223d236b82258b8ac9dbb32d754f05b9350ef51296e56b1073554ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894093, "uuid": "8ffd8aef-079e-41fe-9408-337ab634677b", "comment": "Malware payload (Mirai)", "value": "fba01e7559b0b79e20c3de86b654da31a4840b2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894093, "uuid": "c26c9700-2983-4052-9e76-9eb0bdcaad64", "comment": "Malware payload (Mirai)", "value": "71207744deae8a23c7496b960bd01c151bd8e658a023645bf8feda02b09aa150eb14c076265a4702ed30da49da5c805c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894093, "uuid": "ada63f1b-1aae-4625-bb52-3fff7b2d7c89", "value": "T1BC9329DBF800DDBEF80EDB7B44530906B630A3910A831F3662677967EC761E45866F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894093, "uuid": "00dbd8d7-b7af-412c-bffc-9a0c56688640", "value": "1536:zwUDhs3CKOOfb00rC80wwI9uhje8GQS132eOPhVfNMsXXtNrxe1g0zVyuStd:EUlGCK9S8Zj9uhju2hFNRFe1gAVy9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894093, "uuid": "fd933b52-b05a-44a7-9ecd-0f178fa014e8", "value": 91423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894093, "uuid": "0d9e3452-ce9f-47ce-9166-f5a74d3db25f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894093, "uuid": "952d8a7a-e572-47ec-83ba-46352f0cf72f", "value": "ssh-agent-auth.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1116ea79-fe93-11f0-a129-42010a9c0007", "comment": "Malware payload (NirCmd)", "timestamp": 1769856804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856804, "uuid": "3088133c-d794-425d-8f3a-5a27cfbd5148", "comment": "Malware payload (NirCmd)", "value": "3e10f07802f1a74280b96328bb6e9c34", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856804, "uuid": "688ef5ee-5835-4c91-9363-0913583f1b29", "comment": "Malware payload (NirCmd)", "value": "88290313eb4c0239d427acc7adb59b9a36bd3cd545a92e152362b15b4c681b00", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856804, "uuid": "42afadd9-0621-4330-8cb5-c267d19e9f8f", "comment": "Malware payload (NirCmd)", "value": "13001e22bdf8b0736bfe656dd9bdd00668a1047f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856804, "uuid": "9573044b-9d82-4000-aca0-010af8749b09", "comment": "Malware payload (NirCmd)", "value": "38cc7dbc59d8348cde5c050a0744a50c7e2b0e9a69fad548aba0d65a39ac3a82c40e38f37095a30236971d4224140368", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856804, "uuid": "d09cccee-6ab6-4977-a4f8-5bd5fd394d41", "value": "T15E0633017DCA8972D47314F30A399772667DBE10BB34CDDBA3812A27F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856804, "uuid": "02e8ac00-588d-4b9f-8daa-b2b76268b5ca", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856804, "uuid": "ee06ac8d-8ce7-42cf-b451-1886e8398b64", "value": "98304:bbT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:T2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769856804, "uuid": "4af9efdb-bb52-4585-81af-9d47571a42b5", "value": 3778076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769856804, "uuid": "4c52ca1f-cba0-40a3-bed5-0a2128c582c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856804, "uuid": "ecf2ed74-51af-4401-9242-268f2011dd17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ac312c-fede-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769889155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769889155, "uuid": "28f630eb-a868-4f36-a044-08824d12dfee", "comment": "Malware payload", "value": "31bc9d59afa9c33506c7f1a0bf7340cc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769889155, "uuid": "b23162dd-721e-4a13-868a-bb83bf22f42a", "comment": "Malware payload", "value": "8a9891ce42121865fc37b5b90197d849c42be0ad46bf8f5b4818aa33bc28641a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769889155, "uuid": "b0212485-a172-47b1-8b23-3b4699c33d0e", "comment": "Malware payload", "value": "c5780d62bd5f1332d534f7b9043d4ccc5687f6a5", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769889155, "uuid": "1799e5a9-61bd-406d-a613-5291caee2eeb", "comment": "Malware payload", "value": "1c3376a18a90b5e9465a4581a32d82102ceb1d40cb80b3aa86a353110622f5953fbb218ef1152797de95b335aecd49d9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769889155, "uuid": "5eaf00aa-8d64-4fe9-a62c-7e8cecb60dd2", "value": "T1625733CAF8D05A8EF87E5237C2E49A45E3D93F8844819A3B358C374775F3A8405B5D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769889155, "uuid": "c44c9557-9b50-4c95-aadd-3c336bf99c99", "value": "786432:OMQFyQYBj1ifZFUL1UKVcqUar0khVjs+w:LQSaZLyH7r08jPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769889155, "uuid": "fceeae09-e355-4d1a-bfb7-c0dec99d9218", "value": 29130752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769889155, "uuid": "bc103e08-fc80-432f-a68d-634a7ca9c779", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769889155, "uuid": "2ae46bf5-7a4f-4035-ba36-08cd569c0d6a", "value": "u1dpd9wqjr.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f11dd09-ff00-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769903750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903750, "uuid": "4c5afbef-7468-4e13-b69d-225725a3efbc", "comment": "Malware payload (Mirai)", "value": "8b36b9ceeadd2fca12f04528b69bc351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903750, "uuid": "d5ea985e-7cec-4196-9a1a-dd828d226448", "comment": "Malware payload (Mirai)", "value": "8b4aa4c623cbb8a93b63cd69cb7e71f93140213a521f5b5e69ce14c79bd6dfd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903750, "uuid": "fb8affcc-247d-4ab5-997d-b6bb616f3d55", "comment": "Malware payload (Mirai)", "value": "a198cf3fdd4186721b849712e1530cf650d57eeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903750, "uuid": "03553145-cedc-414a-b905-ed9af512dbd9", "comment": "Malware payload (Mirai)", "value": "9e180fdc3ecb9ad9462e7a116e2d82d1defe07ce26af35ec5b246ea7d088bd0629ac18d9b00e3d7f79fd47c6f681d5aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903750, "uuid": "63aa4aa3-39e4-45e6-adc7-24e5d52d9126", "value": "T165146C2BB3C3ACE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903750, "uuid": "ddd0313d-dd47-489d-b670-14839f2c62f5", "value": "6144:1R9Om5159ZA0mzoWcz4Mm4ztkES7IKTtRM:BZAyFzQSdS7IwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769903750, "uuid": "e32bfd27-5f84-4722-83fc-608d3ee1425d", "value": 196663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769903750, "uuid": "1096b8ae-23ea-4b2d-a0c1-700404d097df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903750, "uuid": "ac2aad63-4ede-4647-8186-6aad78447801", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22ab330-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876831, "uuid": "8dc3885f-dd5e-450a-a287-ff93e549d568", "comment": "Malware payload (Mirai)", "value": "ae0eb577e5d6551d153d35257fa88bdd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876831, "uuid": "9ee3bfea-1254-4712-b162-cb3c2510fac4", "comment": "Malware payload (Mirai)", "value": "8b5d5b7d29590f6700afe2300561b4d62466038a000c5f328b93ce2129a21a82", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876831, "uuid": "6e3f8cc8-ff34-4d3c-9623-4107dd974635", "comment": "Malware payload (Mirai)", "value": "c310f9c5cfa97f306e154b39e1693e4c8e3b2063", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876831, "uuid": "527ee8a8-61e0-45a9-8034-1dd4395d08e9", "comment": "Malware payload (Mirai)", "value": "618aecb107f13fa69b10177316b6a922a1eb030ddd23d149ed19343cb4e04fbd5d861b0fb116230e884f1945bfbfb03e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876831, "uuid": "dd8bd5c5-add0-4ccb-b047-260c5119135c", "value": "T1A1518989A1444C303CAB6E13E7F6813C388195676CF5FF99DEE4B5E4494EE1871847A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876831, "uuid": "ffad8796-5902-4cce-bc11-35c3f2591953", "value": "48:vn/7K/7N7hn/t/6Gn/gV/zPn/d/KWn/r/oUn/7r/7o7Un/fc/3bn/a/9Rn/P/cg3:vn/7K/7N7hn/t/6Gn/gV/zPn/d/KWn/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876831, "uuid": "3e63ee37-9dd0-493b-bfa4-7da379ea7a5d", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876831, "uuid": "926db976-37e1-4dfe-9a82-58f7a9005f87", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876831, "uuid": "91fb1d1e-e596-4e50-a3f4-f1638a5d6f49", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46360d9b-fe3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769819527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819527, "uuid": "1af706eb-5a63-4b6b-b7c6-67477fd5dfbf", "comment": "Malware payload (Mirai)", "value": "cbb4f47d160beef6be0c252e7e16c894", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819527, "uuid": "0ccd8e23-bdaa-4557-b6b3-ad0c2dbe15b2", "comment": "Malware payload (Mirai)", "value": "8b7c8f3a6c998dcb35251699ffc243d2055476cb67e865396ecc659978b98d17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819527, "uuid": "5f91cc47-a047-44d2-8809-4fba99d83225", "comment": "Malware payload (Mirai)", "value": "0123fb657166103d99b67b7734ed04b8a5e4b811", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819527, "uuid": "80f03e9c-cb13-4e03-bf71-fe75585b6392", "comment": "Malware payload (Mirai)", "value": "7440e6ca65969d6b2d68848933e10c5f8f3f58be5342915be5797434be9ee48276922aca0264cf9faa9e2198696ac81f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819527, "uuid": "07cbfde5-39d4-47da-ae85-caa59c489b1e", "value": "T198056C1BB2F374FCD157C53043ABCAA2A935B42902226E7B55C8D6303E1BE711B19B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819527, "uuid": "c89d66b3-770c-47e5-81ea-4d82b6dabb1f", "value": "12288:QTCftobaY4siXD/WkkLtfJ3Mq4HvK5v+5atrLAtrf8o5dWdzuF9DJyktU+KM9Wvw:Q2F04slkkl5uHC5m5ateAoC7+KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769819527, "uuid": "92551b18-75dc-46da-aac8-1f4c9b9cd0e7", "value": 837288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769819527, "uuid": "00fd70a9-f1c2-4b0e-a526-cfff5a25f157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819527, "uuid": "a0f911bb-9d4d-40b4-9d7b-dfc2e37b1e78", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5e3365-fe56-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769830599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769830599, "uuid": "f6c04854-d8e0-4012-b6b6-5033ba5cadd4", "comment": "Malware payload (AsyncRAT)", "value": "e031bebcb34cd93893dd26d92947fc91", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769830599, "uuid": "51d657be-70b9-451b-bce5-04a11f314777", "comment": "Malware payload (AsyncRAT)", "value": "8ba84ee1a2e71879b73b273bca0fefff808463adc381e4bf6a45141ca5909089", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769830599, "uuid": "534ca630-cc85-43ae-960b-7d82801fb055", "comment": "Malware payload (AsyncRAT)", "value": "4375d4fd5081cf169367eb655e4f1adfc1964455", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769830599, "uuid": "b05bb1b9-1a6c-452a-823a-e19c48a63b69", "comment": "Malware payload (AsyncRAT)", "value": "70b52025ae091f47010af21c5f957ce4fbd670f4c1fb0c1b979e8dc374d9c4ef5d2e92277017402ea4ab0d1a9d4559e6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769830599, "uuid": "4ad34675-1bce-41a4-bcce-75c0a6f0e707", "value": "T127435B003BE9812BF2BE5FB4A9F26145867AF6633503D54D2CC411DA1613BC6DA42BFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769830599, "uuid": "75f54dee-6aa1-4d4d-875e-28df2bd21432", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769830599, "uuid": "32d7299b-f40e-40c5-bced-872239395f30", "value": "1536:/uMbpTA8cj2htK794QbQXSwgGgdIcrNI63cK1t:/uMNTA8e2LK794QbQ9QHr6UXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769830599, "uuid": "953c951f-31c9-4c5d-ac29-e62cc29c17d4", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769830599, "uuid": "baad1aac-f3b6-4383-90d8-372a16322e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769830599, "uuid": "eeeab8fb-4834-47a9-a375-dc6a379d3753", "value": "FluxBet Intelligence.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cfc97f-fe83-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769850046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850046, "uuid": "7e17c724-38d8-4f18-8d44-ed0b12e2b3c9", "comment": "Malware payload (Socks5Systemz)", "value": "daf6d3a5d5e4ebc814f9ba3013d39a94", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850046, "uuid": "952799d3-576c-4be7-b3e9-cddce5c87e3a", "comment": "Malware payload (Socks5Systemz)", "value": "8bdd4ed8a2d2745f44f7d1950630926d5c5c52a081f0e2b20a94682463f3611c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850046, "uuid": "bf72f0bf-a515-4aa5-a274-0b50b3cd3b29", "comment": "Malware payload (Socks5Systemz)", "value": "3ab1e445fa193a460a2a79cd3694266b11b19c79", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850046, "uuid": "ddbe87e5-1a92-4a14-b7f5-3d7510df5430", "comment": "Malware payload (Socks5Systemz)", "value": "b7a279e2d86b6d5fc959d089c0ff6f844366a6e669401edc6c2ca71ab06a19f88831bbaf128641191d491c8f5bc08708", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850046, "uuid": "2c65dfbb-b69e-41ab-b404-56ee5e28dbdb", "value": "T1A8F5331733C0A970EF1329F48D9A6346B479AE691A36263031EC7E0D7E63D35A55B323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850046, "uuid": "b92efa03-a76b-4899-bda1-616a7fd103a6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850046, "uuid": "4bfe12d2-5d19-46b7-b68e-6821dde90ab6", "value": "98304:MBUeQa2vmFzpNGcVuYfChPbliLpjPIxMQceJJ:yQa2uFrGcVoi1jDeJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850046, "uuid": "eb0720a4-4160-4cd8-b54e-e17bda46b8ed", "value": 3475595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850046, "uuid": "d87548e4-f060-4700-9161-71b81e5a43eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850046, "uuid": "07ae9d18-0d78-4a2f-adcb-cddbaf94e607", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42954e5c-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855599, "uuid": "8e36d277-2de7-4044-8502-5bbbc2701f1e", "comment": "Malware payload (Mirai)", "value": "d38f312912bc22aca7a0c830fad23e36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855599, "uuid": "78a2cdd1-943d-46f0-aa9d-509337af28e0", "comment": "Malware payload (Mirai)", "value": "8df5856a5c65b0ded44e350bf4ef017a4fbe8caef702275dc0c935f36bd30721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855599, "uuid": "9e47a0a4-7cd9-473f-a70f-ca75c7a01e57", "comment": "Malware payload (Mirai)", "value": "7d4432ccd0aa481ac2c866710461a9c1c6fb828d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855599, "uuid": "adebb58b-bd33-4b3a-97ed-8caf521fac2c", "comment": "Malware payload (Mirai)", "value": "d4417d7bdf2a7c480801a2a02a94953621ff297ee30c9987682814b11581716370bd8db0f6ef4a8b0ebf092fd1ef27ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855599, "uuid": "51f070ba-1e8d-43c4-ae00-11db18a19a05", "value": "T1BFD35C0673180E17D5A349B02A3F1BE083FEE5D121F0BA89691F9B6A8676D371485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855599, "uuid": "8127e8fb-911c-4732-b478-a55a885b0ed1", "value": "3072:CV0zui1ZhMHJCIqWrpP7OUK3y0uMg9Fk+H:LP1Yiwd7OUKC0uMg3k+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855599, "uuid": "d628ea0e-375e-4f9c-b5b5-cb73c58c059c", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855599, "uuid": "a008162d-2236-4540-be16-3df750c5017a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855599, "uuid": "b5f3e8ba-35d8-41de-aa11-36d89c04467a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b713afce-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876840, "uuid": "580c9e24-4754-46c4-956e-a0321375a12a", "comment": "Malware payload (Mirai)", "value": "8e336f80bd3dce72a69a08610259ca96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876840, "uuid": "ac0c017d-0f6e-40a7-b68a-f462284762fd", "comment": "Malware payload (Mirai)", "value": "8fbfa523a9ea5d080c945ed43bbacbdc9a3846a55d6cd0e3c1b3f2fb0a00e074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876840, "uuid": "a334dd0c-e013-4151-bde9-4b09a708d332", "comment": "Malware payload (Mirai)", "value": "d9583db15920c8f0af5c0a69de102695e5974b86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876840, "uuid": "6642366a-d375-4dbe-be14-0cf3dbf944e4", "comment": "Malware payload (Mirai)", "value": "1006cb53c017a7b47416f2d36ccb231096caaffe182d39ca8e9332c18b80a6e7c82528d3c1ed2dfa16e3df324bddcb01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876840, "uuid": "f710cef4-b276-4e76-b92d-4782d418e3a9", "value": "T13A73128B97965313C6A136B2F23444C4AFFE4B890639BD3B34857A5BF5AD208142F1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876840, "uuid": "b0d6c937-30b5-42d6-a149-3bd76b384504", "value": "1536:fU4JEZ9o05xGq1yK/wXbV2/rJkXfJ7b2Q9BtCH9l03CtT5DVSy+WF8B58YJD//m2:c4uDfF8K/GJ2toBb2Q9Bul03+TFVSy+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876840, "uuid": "93b618fd-3fc9-4598-95fc-ab31bcb61344", "value": 78908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876840, "uuid": "19c4871c-5809-474c-833a-bae7d28a8f15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876840, "uuid": "8d9a098e-835c-44d7-890f-753e80cef0e2", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d51c97-fef0-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1769896836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896836, "uuid": "325e198a-d580-48b9-a3e6-7a890c5a1c36", "comment": "Malware payload (RedLineStealer)", "value": "d17a39209828a2033375cd59759b8f64", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoadedPL", "colour": "#CE452A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896836, "uuid": "a1b67588-8b97-4127-9a42-448053d3a57e", "comment": "Malware payload (RedLineStealer)", "value": "90223a0bf3a14fc840cc51baeced06fd17a7853a52537ab84fbeab4d050e5b90", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoadedPL", "colour": "#CE452A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896836, "uuid": "dbe59df9-8005-4f18-a252-fd5e8f3a99c7", "comment": "Malware payload (RedLineStealer)", "value": "d5cf2558d6e0ebf34b19fab430a2c4b98d1d922d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoadedPL", "colour": "#CE452A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896836, "uuid": "312e5e96-2c61-4276-9cb3-f11a5800bf12", "comment": "Malware payload (RedLineStealer)", "value": "968a1eaa104eecab3bf4f1b22bc867380b148d1cc0f5146403538a54cb8953c3cf780847c07d370c3fa56ff8c020fb12", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoadedPL", "colour": "#CE452A", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896836, "uuid": "022b54e0-7d3c-444a-ae83-2fd2eac38461", "value": "T132645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896836, "uuid": "80eb3af3-a26a-425e-8bc7-96c6b108bf30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896836, "uuid": "cb3962e7-f5ee-4365-bb4e-e642db6dc0ea", "value": "3072:KcZqf7D34tp/0+mAEkyQMgQkgghB1fA0PuTVAtkxzG3RceqiOL2bBOA:KcZqf7DI3nKTYB1fA0GTV8kUkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769896836, "uuid": "9d11cd58-fd0c-4554-95b3-ea7b4e17e176", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769896836, "uuid": "3c9e38c1-ae65-45b1-9e20-8b72d5cd0c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896836, "uuid": "397fdb86-e8ad-4cdf-9903-231c82814386", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89230105-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846698, "uuid": "54738d32-0a84-4fb0-9a77-70fe2f63e38a", "comment": "Malware payload", "value": "9eedddd9f374bd074847556a13d07377", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846698, "uuid": "6824038b-7cb2-41cd-a38d-94446505aa5f", "comment": "Malware payload", "value": "905492e10401bd587ad809ecfd26c8db82663e16dae377c27ee6bf6bb2660862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846698, "uuid": "96433e55-4a68-4c6d-9a23-8037e7a3aa56", "comment": "Malware payload", "value": "e15fcf05d0c5f9785959eefd2d51b0ed80017aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846698, "uuid": "4f6763b4-b34d-497b-a7cf-8957a4313d7e", "comment": "Malware payload", "value": "deaf7b908986c1bdb086fccefe752d22d36f907f60c58f0a7aa88c128391dd679317008e32583737d09e2e6da18b55a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846698, "uuid": "7686d83c-7b86-4cce-a065-5c24480f112d", "value": "T154856B52F666C0ACC569C4B4934BA633BB72B889073179FB17D08A353E55FD0663CB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846698, "uuid": "5d935a54-28ba-431a-9f9d-d61556a78155", "value": "edfef0efa058d43bc97cc6097ce6dd57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846698, "uuid": "dae30e51-f9c1-4472-a9c9-63ffb1037a51", "value": "49152:WrH/JzKV2xDBpcB/sxNB2frU5fJEIaSL4IU6i:sZTpcyHaWH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846698, "uuid": "6b22b73a-a640-412b-b5cc-9ff0a56f0068", "value": 1807360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846698, "uuid": "0e3c7658-ae43-45be-a40b-7755ad87a5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846698, "uuid": "0bfc5d43-4296-4dc9-b12f-300688d607e7", "value": "905492e10401bd587ad809ecfd26c8db82663e16dae377c27ee6bf6bb2660862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f7e35f-fe6d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769840698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769840698, "uuid": "00b2b00f-8614-4e4d-a503-2ceaa4670459", "comment": "Malware payload (Mirai)", "value": "fee1d0b52f41b3a74e54bea746d28778", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769840698, "uuid": "3d8071d1-238f-4121-b9f4-44f3d590668e", "comment": "Malware payload (Mirai)", "value": "91cf5ce57984450cd6d1a0d2ddefa31605ebc50897eb129828ae0e25c3fa9ec3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769840698, "uuid": "f51f706d-5cda-418f-b0f0-54e41612f3ed", "comment": "Malware payload (Mirai)", "value": "cf8f09e27bbfc2bd469c43bdf30be6db467ba5f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769840698, "uuid": "52f45c31-5c3a-4f8f-902c-04b2211b7759", "comment": "Malware payload (Mirai)", "value": "eeea78b2b299c5571b80c64510b5293ed5d0a6f8947cdaf833d5f10a5df7823ffe53f5aab849917e27ea2767c873beb5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769840698, "uuid": "90d34732-32a5-462d-a195-be94aa3f5cd6", "value": "T105F096DEB8114AD3060C4E85B3AA9484B8D1D299D1A1EF586DD464BE0EE7B087718674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769840698, "uuid": "6c8068c8-c8af-41b9-bfd2-6a4fc1637921", "value": "12:jdgytwdgy34XdgyhNIl5qGjdgyq0LK0DdgU6mXdg5aKGv:jdRKdR30dRhNI7ldRxK0DdSed0FGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769840698, "uuid": "4326dad9-c941-479c-8f83-9caa545e5e47", "value": 519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769840698, "uuid": "28ccb664-ac18-420b-af30-459563ce7681", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769840698, "uuid": "f64b7f4b-8fd6-42b9-a794-978f7acb9334", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a665a0-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876834, "uuid": "c0796236-39a2-4d18-a9e3-54c94aa37406", "comment": "Malware payload (Mirai)", "value": "ea1c96dd419b9837bbe8022c63a91650", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876834, "uuid": "00f9fa10-d244-4a6f-a084-a73bcc0a3cab", "comment": "Malware payload (Mirai)", "value": "93a20b4053f77a503602816a0c36cd7e44eb2c66c50ffcf688dadecd0596d1d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876834, "uuid": "fc2f0943-9e2e-4cc8-95a5-0c6c8a7a740e", "comment": "Malware payload (Mirai)", "value": "af09ee26025c102c9bed03b2140ab6fb6cc49713", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876834, "uuid": "225ef77f-66a9-4436-9ef7-1fc438575ffa", "comment": "Malware payload (Mirai)", "value": "a5ebf338f0cea56c18cea86ed557a7ea9cbbcd54beed6976a92e21dbe1bbdc2125fb178e423ad823962f68c4affb8ced", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876834, "uuid": "dcf6b800-68de-4053-bfa8-7d904590d2c9", "value": "T1FFF39DA7F20B1091C86306F51BCF6F9D6A2325464FA796E3BC6A323A1E365CF1504BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876834, "uuid": "46db8548-6934-46e8-9880-1d70c40c94a8", "value": "3072:l+wVBml9yCkD87zx+VerE6PbNYB4rz0bg5C0mtfOF2ub01i5q:K+Dc+mdI4rz0EC0mt235q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876834, "uuid": "383d5c26-f2c0-495f-96f4-ece516a0f3b3", "value": 157404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876834, "uuid": "2f984183-35ad-4411-bff9-1df7248ede9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876834, "uuid": "8d0d8068-a546-4a2d-a805-842e8d6a226b", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aaff309-fefd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769902320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769902320, "uuid": "922ff9e3-93c9-4bf5-85a7-07e5010581ad", "comment": "Malware payload", "value": "ae2603ba9a74e6a2f517e42c5fdfda69", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769902320, "uuid": "5b4623ae-6ad5-470e-8e5d-b6e87d313511", "comment": "Malware payload", "value": "9401c933c9f2d1b2100fbe39d46723492c174ecebfa82be8c73f9b4dd9471339", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769902320, "uuid": "bc6ab369-7bf6-47fd-878e-24c47ccefd11", "comment": "Malware payload", "value": "3f1df062495d5b8c1d1794c6ba25815422cc82a2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769902320, "uuid": "ef9188c0-1f5b-49da-b569-4cca2d7a0483", "comment": "Malware payload", "value": "52d33f3cfedaa263f859ce265a52157638d2d245bb014346ee40daac984a3f3037ce53977c4c18a796df833d4fa2695b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769902320, "uuid": "71aed521-c5bb-4f11-bff4-e39c02415165", "value": "T1663194EE70414B622A8D8F40B3B29148F88189D5E6F56F74ADD504E68FD7704379C6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769902320, "uuid": "a8dda9d7-7d4c-4132-92f0-654b66058a7f", "value": "24:nDdCfDiSXdXVOJXZO8dCZDadmgydXe3gdYAWRdeGRdeHpWt6dR0zR0jJdRoBRIAh:nDoBSVUaUVIgJ6dRu3IY3QIA3ES3kGJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769902320, "uuid": "3987fb6a-1797-4531-ade7-7485b77bd36a", "value": 1732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769902320, "uuid": "1ee80602-45a4-4632-b59a-60171e81a8b5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769902320, "uuid": "b30c1ffb-6f43-4e70-a4b6-cbc59cc94b6e", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45298b7-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876835, "uuid": "8c88d06b-06df-4cda-ab02-2286629d6e33", "comment": "Malware payload (Mirai)", "value": "1c1bc0b74dc9ca6b61efc22952b91d12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876835, "uuid": "7b7d1955-b4b9-450b-ade9-0b32375579bb", "comment": "Malware payload (Mirai)", "value": "94456a74ff20f531e6fc9b8c43086e5af0198f550edf699415bda40c6a7f9f18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876835, "uuid": "f9ac0e2e-84ed-4f0d-a5c5-3f8c960ab938", "comment": "Malware payload (Mirai)", "value": "098f565277e743e997aded9581ccf3db5df5d2b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876835, "uuid": "00c260e6-8951-4a16-81d6-b22aaf7c7d8c", "comment": "Malware payload (Mirai)", "value": "13293625520f434273ae6d3c47dc8d67395cc4db12cfcfb3c8d0467c8884a32d9414306023bfa9a359c7628d16302e04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876835, "uuid": "6ccdf8ac-78b0-4cb8-9f86-e6959248a260", "value": "T1C8D35A63ED229F5AC503A0F071B68E785F43A8AA49535EFAB5B2E9F04043DCDB1047B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876835, "uuid": "76879724-5697-41e4-af3f-a36d2dd6f15f", "value": "1536:sa89ee2sg0qsfsXz+XZRrn/CkJKDL5ro/5tViWnW/veX421Q2IymQY2AUm6hh1bL:s7F2sgSsXID/CDE5tTnWHh21m6hh1bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876835, "uuid": "c7049077-1899-41c6-9b2a-931a60e664af", "value": 142736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876835, "uuid": "d42b280e-3ddd-48e7-a53f-356ffd996cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876835, "uuid": "72e03181-02da-47de-8e20-42859e203d6a", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46363b98-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769861188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861188, "uuid": "a1a1a52c-b9df-4387-a200-b553e1410e05", "comment": "Malware payload", "value": "ab2d8dd6f0851e687bfac625407ee90f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861188, "uuid": "7234d393-07f7-47de-84e6-a8b7a63dee27", "comment": "Malware payload", "value": "9588c5edc1700b8312dbd2ecf8dc42d7556a7d15755afe471bd1246732af0df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861188, "uuid": "489e2faf-9d59-45e7-8cbb-2b019d166cce", "comment": "Malware payload", "value": "d594e6dacd545fdc0dfbaa21602fb8581c63fddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861188, "uuid": "36c11c11-610a-4fb2-a748-ef9fdcfd54d7", "comment": "Malware payload", "value": "987b3f5d3a1c5a8dce5c6e30836ef0e6d48855d0efb87cfaae2c68802b10df6beba5a9414b804f49e695a5fdc5701328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861188, "uuid": "317e9b01-3329-4af9-9ef6-e0125b2e540b", "value": "T1AD937D5179D1D4B1E57618391874EAA08B3FF9205F51DDEB338812AE0F305C1AE36EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861188, "uuid": "f1e4ef3a-dc4f-4aa7-94c9-2c2e95a46811", "value": "2e5bc92b66cc6bb503a814886db2b566", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861188, "uuid": "efbfcdf9-d716-4e7b-9e9d-c9cf2914d1db", "value": "1536:PnHvk1oVm8sE6EYyHxkQdjMNfM82v6ANhOcv5SEXi4v6K+zpsWCzcdxIQ3Qy:Pnyo8sxHPjMNfIv6AhOcRSEXiY+Rx9Qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861188, "uuid": "3b919952-8df4-48fb-908f-239ca5e2bff7", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861188, "uuid": "b2965091-1620-4203-9129-453055a21f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861188, "uuid": "07039476-dfe7-4b9f-a44a-408dced2673e", "value": "ab2d8dd6f0851e687bfac625407ee90f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa2698c-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877678, "uuid": "03cde0d4-54ec-4bc3-84b5-f5dc7669e6b3", "comment": "Malware payload (Mirai)", "value": "8af39829c22ee71ec256eb5a6bd88f66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877678, "uuid": "a09bf456-7910-4503-a425-2aa6437a4b86", "comment": "Malware payload (Mirai)", "value": "9598019e3b3d919d7df0e26ad0dcc12d95a6314fc7b3dbfc627bd0eb70437a3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877678, "uuid": "0b596a3d-0926-496b-a6f2-a170f0ede26a", "comment": "Malware payload (Mirai)", "value": "802ca86a003634684683b5228976f76acbf33a6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877678, "uuid": "fdcfceed-9ae7-4e9e-917c-92f765c3556b", "comment": "Malware payload (Mirai)", "value": "a82a443f320ec6dd464ba664dca7c585035359cf1910596f430e13a7f0192a512b2d6f6ad298885b63dda0d45d0f1503", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877678, "uuid": "bb8d4479-6875-496d-8c21-56d76fe7d761", "value": "T179E33A46EB408E13C4D61775B6AF42893322A755E3DB73068D14BFB43F82B9E0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877678, "uuid": "a29d6cfc-2f05-43d2-b972-32119a5d0d4f", "value": "3072:JQAn04oo69B5eWc47E4DdhiienVqNCcjRFcKd51iM/95UEGf:+KV69iWc47TdhiienGCQGK/gM/9yEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877678, "uuid": "409fd2c4-b34b-46d0-8e39-707dfdbbc1f3", "value": 143223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877678, "uuid": "3d35c4af-af1b-4918-aa17-42edeb2ac7ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877678, "uuid": "13d44fd5-f3b9-4963-8e34-5bf23e935f85", "value": "mao.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29af964b-fe98-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769858993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769858993, "uuid": "fe727d92-278c-4982-87ca-7446e4fcd234", "comment": "Malware payload (AsyncRAT)", "value": "af3774fac7386bf4ce7cca8720c7f882", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769858993, "uuid": "1f2f18c5-c968-474d-a714-008a09029a9a", "comment": "Malware payload (AsyncRAT)", "value": "95c9eba0b53e4e0e34741871e350bdd1e9f8ff54f72c63004c8854df6955ffd7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769858993, "uuid": "48d5396a-3094-4c3b-930c-775c4af518aa", "comment": "Malware payload (AsyncRAT)", "value": "42cf462e3afe961f301f44cb4d03a51002cff5a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769858993, "uuid": "72152119-acdc-4ee7-8a6d-c43a1a3efa86", "comment": "Malware payload (AsyncRAT)", "value": "d4d91407253a1969187312d72109de31a26fd58584ab0039fd9798f3a57f0a29089c5617a4280b3d72d14213c513bc06", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769858993, "uuid": "4de620eb-3d27-4102-ad38-f5e40ea11ceb", "value": "T138D24A09B3D48561E1FD57B94D7292048375EE4BA973DBAE1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769858993, "uuid": "24fa315d-3118-420f-b1ad-e387fe42489f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769858993, "uuid": "c9b86f51-a5c3-4aa7-974a-7ebe5437f1d3", "value": "768:AwwbRXxZb2uSEg/cIRGqo2/Rb7fB/dTmSX/+:AbbRXvb2uSV1iIRbN/fX/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769858993, "uuid": "0b6dd891-f60c-4811-b0bf-b4d02c961b93", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769858993, "uuid": "c43e717a-3651-484e-9a3f-5825079acf9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769858993, "uuid": "b49fb843-803e-43f1-86f9-3e3b3df13f79", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17f981d-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876830, "uuid": "8701dc4c-a7ff-4298-a8ae-f2ea16a0ff29", "comment": "Malware payload (Mirai)", "value": "460f8977ba38f0fda215022ca77d081a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876830, "uuid": "35d8dcfb-bec6-47fb-96a7-9bf120258f44", "comment": "Malware payload (Mirai)", "value": "95e905566ec8556ffbb9b909719ae505d66a53c33513434366d354f7248462a1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876830, "uuid": "e066a8d7-5e70-4450-b0d6-68845d2cab64", "comment": "Malware payload (Mirai)", "value": "ac99edbd3a15e3b75fb0bb94d470bd4f41f40af4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876830, "uuid": "3a65363a-e61e-4f6b-a4a5-0280b7843fa5", "comment": "Malware payload (Mirai)", "value": "db2a772318815b5aa06cff7e20d9be04058d46e00674338af7071ce541ffc28c09c9313f3d5e500b49da6ae76ae7c310", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876830, "uuid": "740434bb-71a3-4871-bb76-99a081b38d45", "value": "T125F01CF5B03266F0FC7994825F50F434780084E628D25EB4BDDCE4E048E7F0E284C195", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876830, "uuid": "12e8f984-f317-4c93-8f75-1e459f9b1f51", "value": "12:v0FdJMiXJM8aFHUM8aFg1BF8qvQVFQuZ5QD:UdJhJcFHUcFg1BF8qvQVFQuZ5QD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876830, "uuid": "9c2a6a32-4c4e-4cee-925d-51a978b65bad", "value": 465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876830, "uuid": "5cb43ec3-c9c3-47f2-ba28-5507aeeffbbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876830, "uuid": "d4e9922f-4e76-4595-a866-5000db38115a", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2de8ba-ff00-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769903987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903987, "uuid": "5e1da49b-e057-4bf4-93c2-e9253ff76f67", "comment": "Malware payload (Mirai)", "value": "8c4584e82ea943a340c4f1f8b1da594b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903987, "uuid": "b0775ee2-9602-4b16-ad9f-1af69de341fa", "comment": "Malware payload (Mirai)", "value": "9602edfcd91ad89147c2bd53e616f37865239041833d468172df17255056498a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903987, "uuid": "752c4a1c-17e8-43c3-8bf9-c0681e5aaeec", "comment": "Malware payload (Mirai)", "value": "49025ecfa2d5fdb9fcfecf9c058a9da10fa0a8fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769903987, "uuid": "d61ba8e1-b426-4b62-aabb-e94026e1e630", "comment": "Malware payload (Mirai)", "value": "6ee81a399f48b5b896d06331e81fbd86148710bbeeb770b0404c58f4c8923480bc5eea0b8c7a8f102729eed4d7fd0c42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903987, "uuid": "c4f891ff-ed85-49c8-aa0b-a893ca16394f", "value": "T19E83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903987, "uuid": "d2ca60f6-fee9-4342-bdc9-aafe33ff28f5", "value": "1536:iVLyu95KR9kj752dCexuV/8UZlDwfkJ4MYfWC:iVLyMgqFezxu5VD1ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769903987, "uuid": "27629270-e309-4bfe-b160-1c85e30dec3b", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769903987, "uuid": "ea31708c-c836-46dd-a5ec-b7d054c1c535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769903987, "uuid": "8dcdca86-e0b7-46e6-85d6-822abdc0a7c8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3deaccbc-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855591, "uuid": "203dd723-f3fd-49f1-8bad-ec70eba2da60", "comment": "Malware payload (Mirai)", "value": "228dbdd0895268715be65b473a478433", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855591, "uuid": "2fc627cb-c053-4e70-8a97-c90802f64795", "comment": "Malware payload (Mirai)", "value": "9848d6507964a39ea4bd821c2b51f26e05a352494dc4b2ae6d9e604528ab0970", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855591, "uuid": "1eba2df7-687c-48a9-a995-ca7fdcba7f4e", "comment": "Malware payload (Mirai)", "value": "48c412adaa17d678e0aa8667263b05f5eea4801b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855591, "uuid": "ae50a7d8-3ef1-4fed-8e79-be927ffff807", "comment": "Malware payload (Mirai)", "value": "aa12a0994bfcf997dc79ddeaf515bfb4bca500aad77c155f399162294c289230a2e853d4042cc37136d438cfad03521b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855591, "uuid": "6b84904b-b8f5-457c-b835-66102b59bcec", "value": "T18DF3B50E6E198F7CF79987345BB79E32925833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855591, "uuid": "069280be-63ff-403c-9070-017332f3bad5", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwl:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855591, "uuid": "94727322-6d27-48d1-9a93-1e0572b6b4b6", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855591, "uuid": "991fab72-146f-45f5-ad85-b1a57703424b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855591, "uuid": "9857f0c6-56d3-43d1-a399-f6b6357ac78d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfed94cc-fe3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769819731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819731, "uuid": "326a0a48-1a83-4d97-abf7-08d87d13dc2d", "comment": "Malware payload (Mirai)", "value": "7896ef67c417969c81a0c28adb688692", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819731, "uuid": "f718e29e-b36a-4463-b410-d67ee058bfd9", "comment": "Malware payload (Mirai)", "value": "9a29cd937e70cd96f7c645741d2c908602864508905d0c927002f21a770869f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819731, "uuid": "fe2b924b-bc65-426e-861b-bd307b0c6715", "comment": "Malware payload (Mirai)", "value": "e9474f393b348e58a86a3eeaece68d8f73c0ea39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819731, "uuid": "3aaa8448-6403-4a65-9a71-a6c699833ffc", "comment": "Malware payload (Mirai)", "value": "53567d89df73729a3ef3d9723289b3b0ac13c7ff7d60dcd639e49c1f65193dc359241660afee6ad60ae3195cb2ed7542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819731, "uuid": "38e66471-29bb-4431-85ed-8cb4ce6f0d6d", "value": "T11D1318DBB4099D7CF85FEABE9413490DF631375550830B2667ABFDA36C321648D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819731, "uuid": "eba42fe6-3152-4919-81d6-a2bf57de61b6", "value": "768:1ne3hoZSQh6a5fZYNCYnLIuzV7ajhJ0m+w9w/S3U8jtR:1uecQ8SYNTLIuzdaf0m+wK/SE8BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769819731, "uuid": "9880e7fb-e05a-41b3-ae11-b0b7dd248017", "value": 43600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769819731, "uuid": "64c244e6-b85c-4806-b504-82560a0166d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819731, "uuid": "ab95b8df-0a33-4a63-a549-66522ef94d2a", "value": "0upm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ba9fe5-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876837, "uuid": "2b26440a-416c-4692-b603-b65dce56f248", "comment": "Malware payload (Mirai)", "value": "19d8d89594c65b1f24b91b01fd5a5409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876837, "uuid": "4f80bfca-4310-4d52-b583-ffe28537a46f", "comment": "Malware payload (Mirai)", "value": "9b026b8f0b5e85aec2143e4688b8e6bef572605dfed562af0acd35d160a8b2ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876837, "uuid": "959af7af-43d2-42db-86a5-40ee40777cae", "comment": "Malware payload (Mirai)", "value": "0010e361cb69d2529f58b01bff40d4e54d127011", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876837, "uuid": "2f4fe326-f0f2-46d2-a9df-7820a61ab8de", "comment": "Malware payload (Mirai)", "value": "07051bc625c5d38a6c480771bf5de4b0bfebdf42ebad418b23b4e59ade3def8aa68e4a44d38f25cde90e2c0b7be5382e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876837, "uuid": "3afa6280-9391-4794-8fca-966f3ae2cd7d", "value": "T1036302249E4E9606C6249D750B1E7DE93AE35EF0A68351FFBA2719006F3F081BE148D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876837, "uuid": "368e2bfe-763a-4e14-ae06-ccca9f40296b", "value": "1536:FC1X6AFLvjNRcyFYoasJuTglHLHqszCKGBcYZzylO:9Y16mllDqs2/BcMy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876837, "uuid": "d0130a89-675e-4928-b2d4-82ccc17528df", "value": 69864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876837, "uuid": "828d385a-0ac5-4768-9940-50eceedad2f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876837, "uuid": "d241bbab-1007-4c31-8fae-898d34befd69", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6696ba2-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876839, "uuid": "3640a61b-61ff-40df-b994-2475269b6a50", "comment": "Malware payload (Mirai)", "value": "bfc9d36d12119201be8feb0861f2bc0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876839, "uuid": "c0180c5d-e5be-4ec6-8d18-d2e69a95f01e", "comment": "Malware payload (Mirai)", "value": "9b3ac5f7f52633479bcc2d5d853ab38bb326ed52a7b9acca47a80cfb403909bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876839, "uuid": "47dce55c-125c-498d-891e-65d084f60a70", "comment": "Malware payload (Mirai)", "value": "9a5522151c96657158fa159412e5dc73806e0a04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876839, "uuid": "cc16a886-727b-4a3e-a7f9-d158abef6dd8", "comment": "Malware payload (Mirai)", "value": "698f36d0ea5412bb1b656f5eba3dd76cbccd26df3e7cfdbae37d761238ed6cf4c94f8b699874ce14df9e4cceb5482334", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876839, "uuid": "1fc11259-3a09-4106-81ab-084530779ba0", "value": "T10433022E5F985534D09257369E724CB37686B0E2ADCB59B6A18CEB1C207313E93D4A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876839, "uuid": "b3753ddd-4e3b-4f3e-b47b-0587ffc333aa", "value": "1536:MOqQz8XNJpKOxJchUSI4ALVfE8pghBEXoFxJi:fz8XNrxSI4dQghGXo3Ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876839, "uuid": "3b78678b-b808-49b7-a0d5-01c464cb9a06", "value": 54760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876839, "uuid": "7654f814-7e37-485c-ac7a-42b1d91d39ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876839, "uuid": "58473d03-290d-4a54-a650-c7f6ebaadaca", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cef9db-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846711, "uuid": "be7c978c-a8b5-44f2-84e1-db6b2ea8d784", "comment": "Malware payload", "value": "c3d4d6fa2306932e6d2998849540c159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846711, "uuid": "2641835a-dc85-41bb-a867-92e3e54102c2", "comment": "Malware payload", "value": "9bdef27e3ac4469bc8e6f530d050e2e1c3fc2889ccebe0fa6b12b982160ec533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846711, "uuid": "a6fd8970-f8ab-436a-94f0-e402b7cc50b2", "comment": "Malware payload", "value": "06f537f6605a65db87e5340867e198414db1e9c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846711, "uuid": "640b2ffa-dbe1-4b29-99ea-183dce870d78", "comment": "Malware payload", "value": "55af2b0c0122b8cb07e166617503ed7bfce969e69f9f208fb4a090aa5634e080f14abd06d9cbcebbf3552c743dbf2e92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846711, "uuid": "02189474-486e-4540-9df5-be364ec5422d", "value": "T115F36C17B3A600BBE4739239C9670A46E772B80517619BEF03A047756F277E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846711, "uuid": "c6224716-aa3a-4f4d-af8c-955d3d8ae12c", "value": "f9f0e87ecf133996a285a6a9b5271211", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846711, "uuid": "7d2ad577-4bec-4bb9-81f2-0f8663bfa400", "value": "3072:Fv4CuoDeay7MnUkoojsWKO3BGZuE3WdH8Ri9EFM:FvRu2VyoUFa3B2Q92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846711, "uuid": "278429dd-5476-4fec-8ff1-2ec53c036c3c", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846711, "uuid": "a44d4ae0-e09e-4ef2-8238-a823c2d6f8c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846711, "uuid": "af21fc5c-a155-423f-8d83-4db6b165109f", "value": "9bdef27e3ac4469bc8e6f530d050e2e1c3fc2889ccebe0fa6b12b982160ec533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ffbd86-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884629, "uuid": "b5bf35d6-2132-4425-a39c-1c6121211efd", "comment": "Malware payload (Mirai)", "value": "750f8d657f267a4c6065e9181209682b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884629, "uuid": "ae5f035b-a74a-42e5-b91a-9e6931380d67", "comment": "Malware payload (Mirai)", "value": "9cfb154ae919c63c0d2528bc1aa59e356b5a06c5b4ceb890de84011688d025bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884629, "uuid": "7322119c-3095-48b6-9c4f-f6240924f485", "comment": "Malware payload (Mirai)", "value": "ddf430324e8124d7d8af398e26f5fc740017f9fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884629, "uuid": "74047413-b47a-40f7-9c41-1e73877aad39", "comment": "Malware payload (Mirai)", "value": "dbc16dce62b8f720f27e1c444b5061c30a9f717a55fbf0a9b3c743160bda1dee076b44fde3a284e396b50f052c2405e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884629, "uuid": "a7c4426f-35aa-4a18-a695-985e8a67bf5d", "value": "T177534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F9B9A9675E361181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884629, "uuid": "7a66e042-e96d-4f87-bd5a-5323d1ca841f", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EMwS/p9OyDQvSFRMNYL6FV+tg6wWA:+5HAdOmGyNtTAddOyUaFRMNae+aTWp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884629, "uuid": "ba63d8dc-0e51-4ec4-a630-dfc26b0458c5", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884629, "uuid": "7bc943a4-3c05-4801-ae28-4728e7fcbe08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884629, "uuid": "761a585c-8094-4182-a231-9696a1804f7a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7372be-fee1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769890678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769890678, "uuid": "c9f76253-45ee-473f-b9dc-0e4c35b4eca6", "comment": "Malware payload", "value": "9b60b62ea26845501a06df34968d1167", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769890678, "uuid": "fa73cecf-e1d5-45f9-b817-dbb8d4f1e32c", "comment": "Malware payload", "value": "9d1f28562132b533976fda3b0300ec3d2533bdb86c8784733c46f6999b73094f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769890678, "uuid": "7c80eeb7-b614-4b92-b0f4-986502c011a6", "comment": "Malware payload", "value": "23d64cc7c0b794ff9685cd3a6508b4e3d1b2fea7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769890678, "uuid": "4464e277-5627-4aba-8583-8b480b5f565e", "comment": "Malware payload", "value": "51a62a5c6ae1a7953720b136540967bc2ddd13e8177dd569692cbac2feb0b24b56d701d5c8e38e7191da1df370913742", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769890678, "uuid": "8ff18817-378b-4a12-a07f-8cf370e36b2f", "value": "T1BAF3A621A3FD5108FAF73F84ADB462645E36BDA2AD79D2AC1261004E4AB1F40DDB1737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769890678, "uuid": "a07a452d-33a6-4ef1-b195-c40637152f83", "value": "1536:HG5o975oYz7NFqrjiVdRYCL6wZAU3Icl4fuy1RuK7NFqrjiVdRYy:HG5o975oYaOL6w/Yruju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769890678, "uuid": "3c9efaa8-53a8-4ddd-ba39-9c83a28e83ec", "value": 168164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769890678, "uuid": "a28e1718-bbca-4449-bb68-037121ea466b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769890678, "uuid": "168bd783-b390-45bb-a00b-24fd8381cbb3", "value": "Truewallet_licence_key.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc827fdd-fe6e-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1769841308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841308, "uuid": "15979aab-ead1-4239-a563-e85ac897171d", "comment": "Malware payload (QuasarRAT)", "value": "6c5efec519b2a234d5036ee408d548b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841308, "uuid": "5687eb7d-277e-4f8f-b067-03a222b1437e", "comment": "Malware payload (QuasarRAT)", "value": "9d73688b12994f69f97ff9c04fec2734519b750001b0870b3df7db9de3ee5716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841308, "uuid": "68caed3a-ff72-4317-85fd-a142da5668bc", "comment": "Malware payload (QuasarRAT)", "value": "e956acfc5a87eb1699b000e016dc03b98ce04a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769841308, "uuid": "0bcadae8-1b40-4039-9d92-b9f246317b54", "comment": "Malware payload (QuasarRAT)", "value": "69e86a4b97fcc0f6b768587ee2602af05e93309b9bb1d4484b15f297c973b80d00d2882ba130b44d2d2cf7c8c03383c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841308, "uuid": "1f2f75e0-498b-4329-95e9-d814c127c38a", "value": "T1DAE55A1437F85E33E16AD6B3D5B0541A63F0F86AF363EB0B2181677E5C53B508842AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841308, "uuid": "83bc69d2-dede-4da8-a300-f47e6f975320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841308, "uuid": "8a6aed62-e426-4e9b-8698-eb967fb35c24", "value": "49152:LvulL26AaNeWgPhlmVqvMQ7XSKsv1oFs9AoG50G7THHB72eh2NT:LveL26AaNeWgPhlmVqkQ7XSKsvesW8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769841308, "uuid": "1f84a0ae-35f2-4022-a5fa-0793ba2399b8", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769841308, "uuid": "1b46f41f-2de2-44e4-975b-6997b8829587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769841308, "uuid": "f43607b8-c641-4065-9d39-95b91a4ccd75", "value": "jammmmmes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d140fbd1-fecc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769881608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881608, "uuid": "b5d1e98c-287a-4b3e-a3eb-6b4a801733e2", "comment": "Malware payload (Mirai)", "value": "9f93ce595903a14c43eabdf8b193a54e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881608, "uuid": "e5946a01-cac7-4e5d-a4c2-538a9e456523", "comment": "Malware payload (Mirai)", "value": "9df30fb233d29d137447f3bca56bb18beb988665c95425675b583dbcedea94c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881608, "uuid": "38933cd8-8587-4c2d-ba7f-7f1bc7448e07", "comment": "Malware payload (Mirai)", "value": "b4c18b8777eb2d41e699050fc295c909a8255098", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881608, "uuid": "6ad2adc2-993b-4957-b731-70883cd29033", "comment": "Malware payload (Mirai)", "value": "3f72693a3dcb18bb96bace6cd55bcb7e7f2cd178268e84c81ab8b8b1d6cda4b737459122ead8fff294270f3bdd1a6abd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881608, "uuid": "de45d195-5f56-4ce1-bf97-124bc2bb66fe", "value": "T176C43A55F8809F61CAC52976F79D869C33134B79C3EB720699144B383BDB8AB0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881608, "uuid": "21487cee-9eb4-426d-8033-f7102798eea1", "value": "6144:spPwjcQviLBH2mh8PS0X9nkJQm8aAO8onyy5hRuNfN4e5bCfcwys+u2hgpuorN/:UPINviE3S0XKZmOuR5CmfhgpuorN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769881608, "uuid": "f1a78fd8-c2fe-4a7c-81f9-f97eb7d16ecc", "value": 566592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769881608, "uuid": "95a87719-2564-40af-a221-4c3067813eef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881608, "uuid": "fcfda333-20aa-40c5-a6e4-5ddd07522cf0", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0492d7bf-feca-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769880406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769880406, "uuid": "a3f11984-08b1-4193-a986-6a1fdf342383", "comment": "Malware payload (Mirai)", "value": "5b228115b4fcc81055fe942af1738e16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769880406, "uuid": "998cef0a-c6ed-4825-a349-2f44a9b706d3", "comment": "Malware payload (Mirai)", "value": "9e5eb31ffba0a25fc1f9d89aa94acd47a20bef7cbe415be4a03d6dbee2006648", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769880406, "uuid": "3ee2311c-e7e8-41a8-866f-54bd8664412b", "comment": "Malware payload (Mirai)", "value": "8467ee7ccb7b2ffa781562ea34444550f51ece64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769880406, "uuid": "b90b6f46-eed2-4ee4-be29-2c4eae651719", "comment": "Malware payload (Mirai)", "value": "10827ebf6de88ff6666891992a93af3926c965d8e4fee43b8ac52f779fc22d35f05bfb436499a009c9d0a81fdece6af4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769880406, "uuid": "11abe617-8b87-4717-bf55-8290f34c202d", "value": "T1CAD47D59FE5E3C42E2D7E3789E4D83E1B32771E4D32391A33982434CD5CA9E98BA1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769880406, "uuid": "757e46a2-7707-425f-9edb-09dba7a58e53", "value": "12288:WMAZ94zuyRM0MzSnsF0l9wDFxDcReZtbIDnCzhH1yWw5nzUZ1dB:WM6CzuyR2U9wD/DweGXb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769880406, "uuid": "e86c9be4-15ad-4d50-9b22-a00a89907275", "value": 644320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769880406, "uuid": "05d5e4d9-8612-434b-a4f4-89f650ffbe6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769880406, "uuid": "664925c7-acee-43eb-b3e7-0944d2954125", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee0b87e-fe9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769859995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859995, "uuid": "033e047a-8937-403e-a6a6-a420c148fddf", "comment": "Malware payload (Mirai)", "value": "6c47788accce2536ca59f1c81ba0ad48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859995, "uuid": "6132d127-bf1d-4931-83e6-69e30fddcab2", "comment": "Malware payload (Mirai)", "value": "9e6ec64dc19e5ddf7637b525d3efabb389310135eb7804324759301cadda2e43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859995, "uuid": "f9b36973-2507-43de-8b27-a07ce2121a1c", "comment": "Malware payload (Mirai)", "value": "dce5e7fb6ea96238fb646a613b7a40cd7489c904", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859995, "uuid": "f02c5da0-60c9-4738-8ab3-8f5bd24f1307", "comment": "Malware payload (Mirai)", "value": "c516e2882ece912ab158373e5e5498b04fd0894d84d8b91c91062bb9b148e0b8723e5b4be29b3aba6c74d2f8951a52c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859995, "uuid": "c1d07a70-d6a1-4e9a-8333-abe56735c779", "value": "T1A3C2CFAE0B0254E9C95B01B6BFB80BC02F660B634A06DD0B3AEDD916DD4656D64A37C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859995, "uuid": "8ce0fd78-512c-44c0-a40f-10de20c1e725", "value": "768:YsgQBA1GCJIYIrC/+HzjRjpBgOFJgGlzDpbuR1JGq:VdAoiT4yKjRjVVJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769859995, "uuid": "48b9f752-334e-420e-833f-24654b033ac3", "value": 26764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769859995, "uuid": "55525966-2ac0-48ba-8895-3de247f451b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859995, "uuid": "25107ce9-4152-454f-9676-889d53b0a5d6", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5f3ef8-fecb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769881117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881117, "uuid": "d35ce07c-370d-4ba7-91fe-6488162c9a07", "comment": "Malware payload (Mirai)", "value": "6a8c9558517b35beae23c5dbeae8c308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881117, "uuid": "bc3d64ea-035b-4c8a-91bc-80709fea95d7", "comment": "Malware payload (Mirai)", "value": "9ec8fd5513e442c6dd89ad271114c4d1cabc55f5cd79a653c4633d7ad13d73c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881117, "uuid": "fdb91156-80d2-46fe-b67c-82dd13491baa", "comment": "Malware payload (Mirai)", "value": "42108187d36e9e30505c116fa08a7b4c42eff10a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769881117, "uuid": "a65f9367-2f41-4598-a443-dd906c1c90e2", "comment": "Malware payload (Mirai)", "value": "c473b814669704d33f5ce82e6b4258c40c71f321cd3905b6b651c5d02692d82ffeacc61cd2f52bb2f9cb5f61edeab74d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881117, "uuid": "80fa75a4-b38c-4b23-8b4d-04ef69b0b18b", "value": "T1EA934D49F753E0F0DD4706B1115FB73D8634EE624024DE6AEB94BEB6EC32A02661B61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881117, "uuid": "f626b3ce-b53b-441b-98b5-a8145a327840", "value": "1536:BquYV9Kj9sRGRtJquiZmoMTDCyZMn/5OdtIGDT63jTrqgU531IiC6/dr:BcWyGrJ9QpMTDXMOvTWwSir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769881117, "uuid": "56e4b81e-fa06-4b4b-a129-a6bb44d12496", "value": 96744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769881117, "uuid": "48b5e791-d977-460a-a17a-66a478bcbb68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769881117, "uuid": "1108cd0a-1a64-499a-8427-a7c2e4a5b70e", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d8d855-fec0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769876247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876247, "uuid": "ff7ca967-d506-4658-b926-f5a628026fb9", "comment": "Malware payload", "value": "fd6a6026f95e60a7c9316c60329bca2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876247, "uuid": "7ee46ca1-0030-419d-a268-d4812527080e", "comment": "Malware payload", "value": "a14ae4a54aac7f681cd91aac72f9292552c16e17395cccb12cbb63a24379855f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876247, "uuid": "00b5f4d4-22e4-4516-a591-9d499a6efca6", "comment": "Malware payload", "value": "9c79d0d0101bffd67fb35b38a82de1e86bc2d7e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876247, "uuid": "8f249142-cfeb-49cb-beb2-8762a8fd217e", "comment": "Malware payload", "value": "b872d9ff2329c110b14ec8a32a33dec6fd53f09e7614d145435ba274e24befd1aea36d2199333c14eb9cc5785f5406e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876247, "uuid": "08aaa5f6-6536-4f4f-b7ed-07bc005a3180", "value": "T1C5848E15EBA540FCE0B7D174C9A24906D772F8CA47B1AA8F03D459961F277B08E3EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876247, "uuid": "e096e6d9-f506-4915-851e-f992211bcc0f", "value": "1b9ff28cba99b60258984d40b6976b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876247, "uuid": "8f50cc95-2d87-422a-8340-1ed0ad43dfd7", "value": "6144:YMUpp4W/I3jemAVQ1sww0y5gTF+MrUf/oOR7oTrRERDM:pUppQ3jUVQCwtB5QHoOBoTrRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876247, "uuid": "223e8aef-f929-4b6e-aec2-4be4a865c832", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876247, "uuid": "13aa515d-4870-4d4d-8b46-99adea51c4c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876247, "uuid": "ecaa46a0-119d-487a-b185-f828d2c1c11f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2277e9d-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877771, "uuid": "e7494810-dd73-4d52-937c-42d37bfdbcbc", "comment": "Malware payload (Mirai)", "value": "2fbaae4829d582efd158ab44d3acf6dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877771, "uuid": "1899d989-0993-4544-90d4-6d00286d47e5", "comment": "Malware payload (Mirai)", "value": "a1cf80d0816c77f25ef181424cd3b806898d6657f2226791e672d20c2a725305", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877771, "uuid": "89995de1-effc-492e-9ef7-12b2024fbeed", "comment": "Malware payload (Mirai)", "value": "1759a31fc2b67487083693f4be6e9745f9648b9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877771, "uuid": "912c2bf1-17cf-41df-82a0-9fc1577d2665", "comment": "Malware payload (Mirai)", "value": "ab00f360ef71b51f4b070f93877533f4ae19eb35022aaa0eb72abc3b9dcc38347def2b2573322cfc7e2fb9504c544194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877771, "uuid": "b9f9d20b-d921-4dbb-a231-948cc91d4b03", "value": "T1E2633882FC81DA12CAD4237ABA6E51CE331133D9E2DE3247DE126F113B8A95F0D6B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877771, "uuid": "bef8c501-2e74-47b4-89ad-f3e16780c0b3", "value": "1536:5c2JSw6R/jLoMg53Z0Z5MZWJ3erhOjFw:5jJSw89DMZy3erhOjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877771, "uuid": "1a74c583-d254-49ba-9517-c2f0e2128647", "value": 67208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877771, "uuid": "11d3a4f8-2dba-4b92-b3c9-ecc113a1194b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877771, "uuid": "f9dd1951-4f88-475f-95ef-b43381f4e473", "value": "mao.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d825f48-fe9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769859993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859993, "uuid": "dc0fe13a-80fd-4a56-8d6c-fea6cc6d2c12", "comment": "Malware payload (Mirai)", "value": "7f743f2ced056665d4d06dabc77a8896", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859993, "uuid": "ae151801-dd99-4ab6-b7b3-2d70a928447c", "comment": "Malware payload (Mirai)", "value": "a2ded513c4266461de5786f3304cd28b0e9622815e279080052146f96b59bf63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859993, "uuid": "520711e4-c285-428c-81b9-b2300c73f6e6", "comment": "Malware payload (Mirai)", "value": "461ddfde7876eae60c56b1481a170a5f875cb49d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859993, "uuid": "29ec085d-f1ee-4589-a7ef-7d89fe58a9a8", "comment": "Malware payload (Mirai)", "value": "0b3096aed255b4cbd4c431086c645601629bbafac78e4b95373c560fefdf30f835e0dd9c52de11431688158c8b7b4303", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859993, "uuid": "77327d35-4b9e-4eed-956b-9dee9b3acfe7", "value": "T150B2D070D3A58E91FA7F7DB63E2164C637B54B6B323B87A9B0815EA090122719114FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859993, "uuid": "913013a6-dcce-4cae-b809-c3f224fda50b", "value": "384:EG7Z8Y9y37VAuf8m8gkBjzwjE6scDyzNG1qUPHeVNe7QgM4uVcqgw05sxJl:fOY837VZf+FwjE6rDyzw19HFo4uVcqgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769859993, "uuid": "89bbfbbe-cc6f-499d-83f0-cf0102ec7e55", "value": 24408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769859993, "uuid": "a1d25d47-6949-4ecd-b280-ee3658d997d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859993, "uuid": "8348c1ef-b3ea-453b-9d4c-a8948db57d61", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293f637b-fe39-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769818190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818190, "uuid": "6acc8ba9-7e25-4e7f-937e-a9ba677c0573", "comment": "Malware payload (Mirai)", "value": "e5fde89cc816b94523296aa0a7b25bb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818190, "uuid": "0ecf203c-c0aa-4d5e-9c88-241e16d4bc94", "comment": "Malware payload (Mirai)", "value": "a67a35781ab666ad5ab6f87baf53b869b87ff7e313a7a0af676af1dece2354ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818190, "uuid": "5d90fedb-e8cf-4480-8810-b9e0b14b1fab", "comment": "Malware payload (Mirai)", "value": "b5da4459344f5176138c25281444e580330a7e03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818190, "uuid": "34047b9c-1e3d-466b-aab0-eafa19ff8e60", "comment": "Malware payload (Mirai)", "value": "6c7ca58b76d62921503922051f2e09d5f7ded4943875c5cd2c60595666d583c0668598af3799877705e916d974b0cdc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818190, "uuid": "66e72d7a-cd54-47b0-8182-761fffbac4de", "value": "T174B3F90ABFB11EFBD4AFDD3349A5474938AD550621B93B393674D81CF21A68B06E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818190, "uuid": "b5bdd67b-7f8f-4047-bb3a-fab12db02f8a", "value": "1536:hkGgo4iIuUg2X5/amobdqMD3qX0U5qRYChMbh881+Bu1u/7mj4aZfqFX39wu7r8B:hpVLdq2s44QvEiY+eDdrvOKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769818190, "uuid": "a9d62452-1c8b-4e9c-a2f5-1c7dcd840f31", "value": 109352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769818190, "uuid": "68eb1873-108a-49da-af96-66bac47c4749", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818190, "uuid": "bb459cd1-f463-4ce3-9ac4-bb25c79dbb26", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec31c2b-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876853, "uuid": "786a94d8-12f3-404d-9e90-88f302255f4f", "comment": "Malware payload (Mirai)", "value": "f0e5e8baa7231e9bde1a107cc1cad2a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876853, "uuid": "72da03e2-d4b3-4e4c-872d-1ce35f9ff9ed", "comment": "Malware payload (Mirai)", "value": "a69b018f65683c2bd2ad8b250d5ae0b267a63327afeb08175687a6a2cdffc2b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876853, "uuid": "2eeff942-0717-4a51-9c51-77a2cfc92536", "comment": "Malware payload (Mirai)", "value": "a86cbda6adc86a1335c8d3c8a162fa5a3dc5e298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876853, "uuid": "ea98408b-d051-4dde-b46f-9b75eca4c77e", "comment": "Malware payload (Mirai)", "value": "1f4cd941b4518b1799d81df611fa006fac5465912225a4c76769d0393cba6276d7c32b19a6152ae4fa3c1e9511228cc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876853, "uuid": "8c15b1ac-b377-4ace-8fdd-89674eb19300", "value": "T15F14851E6E228F7EF6AA87B447F74D209B5872DB16E1D680E16CD5101E102CE641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876853, "uuid": "da16b8e7-69e0-4b99-9494-57c6bbbfd457", "value": "3072:rKw/TTjxyynDi2qvSFu8w9w0VmUlDM6hh1P5VAhN:rKw/TTjxXD4IwwLUpz5VAhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876853, "uuid": "78ffd6d4-846d-4263-8864-385db6b94cb0", "value": 208680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876853, "uuid": "57bf4d66-1bb6-4106-83b8-d152e447ff91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876853, "uuid": "d47f4f77-b089-411a-aed1-7acea1e06255", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229382b5-fe3e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769820327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820327, "uuid": "2a7b83b7-6d63-44d3-844d-51d84adda6af", "comment": "Malware payload (Mirai)", "value": "0422537022cfc919bc84be76c195b17c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820327, "uuid": "3dafad57-d2e0-4b5b-82d6-8ee716206917", "comment": "Malware payload (Mirai)", "value": "a6af169f78344f050979a4bd33bf7d443f9d5562b2adf8bc3c6aee52025e3c2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820327, "uuid": "c6d410af-9584-48ec-83b1-5d50e794f94b", "comment": "Malware payload (Mirai)", "value": "355fe361a0633a26b8e8f17af68c31fd2cad0bdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820327, "uuid": "7b3cfe9e-a369-448c-9a29-083c40a5ae0c", "comment": "Malware payload (Mirai)", "value": "98587875fecb751fb477c9b15615a799443af18485614fe966f68e5c9912dcd892b155a97751adccb34bebedf5d36c39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820327, "uuid": "836dea49-faec-4804-bd41-262fb82c4ef9", "value": "T13983178ABCC4C602C5F061B2FB1F51CE376643A8E3E6B157CD19AB29634F8970A37255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820327, "uuid": "e63f5864-581e-440f-b758-b327ce491bc3", "value": "1536:mVixeBlI7OVOCO/Eisc4hXiOV+YMZT2KXKvw+Mlb5X:mVYeBq7UeEDNiOV+YETCw+Ab5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769820327, "uuid": "d6f09dec-ebc8-442d-ac2f-1516d0fe2803", "value": 84488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769820327, "uuid": "51f2f619-af29-4103-9cc7-ec6bc5ebe895", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820327, "uuid": "bb9ccc26-5af2-46f1-99e5-9b232681b3e1", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3a9b50-fee9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769893953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893953, "uuid": "de5a424e-8ca8-4a9e-a240-f77b316f34c6", "comment": "Malware payload", "value": "cf995062e2f8e15f228da74cfd02d377", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893953, "uuid": "5ff760fa-79d3-452d-9ecb-830902487d79", "comment": "Malware payload", "value": "a9986fc2e5b5d52282c63fb2a22d1464d94316b2e34455310038542de368ed2a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893953, "uuid": "67dde2b7-f32c-4690-a865-72f254e5725f", "comment": "Malware payload", "value": "21a4fa6529f04da9be9cf8b87fc0fc7c64bf5143", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893953, "uuid": "71d8e512-2c1f-43ec-b8a4-479ffedf89d9", "comment": "Malware payload", "value": "2bdc7173c844af7dafa11266f28f7e37c051838f2ce18e496da8785d53c6ea3504bb07b5699ee2e68e30f2d0c1b57d5d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893953, "uuid": "4a1353a9-f29b-4c35-afaa-59513c6f2758", "value": "T1744628AB32E486B9C11EC23FC4A28F40D4F7B175073BC2E702911768DA664D56E7EA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893953, "uuid": "86fa40d6-1afa-4fc1-9998-0f6701fe61a9", "value": "07fba07802e4a95408526be16e22b7fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893953, "uuid": "8463cc55-3d92-40d6-b17b-eaf5f0211807", "value": "49152:1lfUFv3+WavCTC1DtFSPzsSxuB8StMAnJuZyekT+dtA1+PPN:bkVdrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769893953, "uuid": "6f313de9-a616-4099-bfca-c1549e1e0d2e", "value": 5359616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769893953, "uuid": "4d6c3d44-9628-4b74-9659-24c067306a47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893953, "uuid": "5e49869c-aa9b-46da-9c7b-1d5564129f7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fa6dbf-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1769861207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861207, "uuid": "5ae313e7-79e1-4ba2-8918-691de56bd704", "comment": "Malware payload (GCleaner)", "value": "7f8eb6e0752796a4b8cca9fcfeec0efc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861207, "uuid": "6c974bac-d93e-4373-801f-e1916cef9bb3", "comment": "Malware payload (GCleaner)", "value": "aa9609826b6fe268a2b6349d64f226af94ff4ea1ce5ba68e14a9aea7ab47127b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861207, "uuid": "aca61e49-e690-4681-a209-436390e2dad2", "comment": "Malware payload (GCleaner)", "value": "b7370523ba6f4d883c2e801eac14d091adfd3bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861207, "uuid": "88d102bd-70ca-4ccc-b102-877ce6299f9e", "comment": "Malware payload (GCleaner)", "value": "13adea5057217cb4833323534d6b58ac5cad205e9c109dc350a09b27b5411f60aa3469907748caa4811fb43069e519c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861207, "uuid": "d5f0900e-c34c-4ec3-a724-d88fc84afebf", "value": "T174E49F12F6918432E17F1A39DC6BBE645826BD9039386B4B36D93EDD8F76341341A383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861207, "uuid": "8286dc99-4d50-4019-bea0-70c2981ee66e", "value": "07f608b4818de60660a6d587f85c6c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861207, "uuid": "350488bb-f1ec-4bb2-abf6-6629be5ebf8b", "value": "12288:pTYcy8yZ08zaVh6E3DXDun6/L+46fFfyRc0ViYKG:pspV/YdmnYynfwcEiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861207, "uuid": "dfd1e4bd-8a9c-469f-9493-00f89fe0ca52", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861207, "uuid": "d2d2a3e7-dab3-45c3-8142-ff52febed075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861207, "uuid": "0eb802c0-8b12-417a-94ae-753a95e18caa", "value": "7f8eb6e0752796a4b8cca9fcfeec0efc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418d29cb-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855597, "uuid": "38757c78-2ced-4cd9-b2c1-aebf9c43bb58", "comment": "Malware payload (Mirai)", "value": "f892481e588761e0f0eb294e7584f196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855597, "uuid": "3d88b9ec-1486-4c77-856c-420e6c9bc1d4", "comment": "Malware payload (Mirai)", "value": "ab1c90f741bbc11723e5178e12a4def7e51724cc71a3ea7ca64f6fb4e5c1104c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855597, "uuid": "fbb209d1-265b-4868-b27e-8e31818e3abc", "comment": "Malware payload (Mirai)", "value": "bcc1045e063f58b7e803feb0a13c918b4b177bfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855597, "uuid": "5e38fdc7-c723-40a2-b146-e24d4032b167", "comment": "Malware payload (Mirai)", "value": "f8abd0afc7ccc79a71d0cf01affdb713f9036a32a9bf87b0cb149501d0f5a0815ea075728923b0570d98f95fabf67453", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855597, "uuid": "1a08d5dc-4ae9-4409-91c2-d976155062cf", "value": "T149E34D8AF802DE7EFC0BE57E44670D15FA30A7613243172D529BFDA3AC321A65D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855597, "uuid": "cbcce9b1-7851-457b-b2ed-9e2665f2e044", "value": "3072:luWypdcGShA/TSPA39TsZJ243nxl9XzrTmdGp:gCGShAr7ThAxl9TmdGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855597, "uuid": "01fa4908-11ae-4d86-9e00-60b726ab93bd", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855597, "uuid": "65c7a51e-77fa-4f93-be24-52d0d73b0c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855597, "uuid": "a70577dc-c153-4321-b11e-7df6ede7a676", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78896c11-fece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769882318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882318, "uuid": "e1b7e30e-588c-4aae-af36-c939117c59ac", "comment": "Malware payload (Mirai)", "value": "b2a90c4d31521cd1b470705209962e91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882318, "uuid": "ff56023d-fb06-4625-a9b3-b48aa849aa32", "comment": "Malware payload (Mirai)", "value": "ac9a70349a95b28d9126bf047b784badb5022c1d09eef334d00f12e0c7ed176d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882318, "uuid": "d55da2f5-73bc-44fd-b2fe-fca425fe9e24", "comment": "Malware payload (Mirai)", "value": "0e58def036f654e56e0ee38a5f3e7bb75d1a082a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882318, "uuid": "5911bbef-2307-4e89-93a9-f887f2dab40b", "comment": "Malware payload (Mirai)", "value": "35c03f90a2402b0c1e8ebc664285d230654bcfaa40c62a06f5fccd8051fe07ef7ef66bd66fafe617c1e54b1cd6d99660", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882318, "uuid": "36e05d16-9ac0-47d9-a134-e9c913096f86", "value": "T1C1A32B46B951CA53C5C221BAFB9F424C37226BB8D2F93212DD24BFA127878DB0D77152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882318, "uuid": "84394905-5b08-45fc-89a8-07618539d503", "value": "3072:s7aWfQx1YM5opbaMfvgzW3OFrJh1KXBTDSKu5i/:s2WYx1YM5o5Dv3Wz1KRTDST5i/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769882318, "uuid": "3c28ad5b-7313-4d1c-bf8c-9ce525591252", "value": 102304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769882318, "uuid": "7243571e-0a14-40b0-8708-ecb36618af94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882318, "uuid": "fde90eeb-2297-408b-9e8b-3fab6104caad", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd8dd3e-fe9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769859992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859992, "uuid": "30125d22-673b-4fbc-b8c7-37b51faee0f0", "comment": "Malware payload (Mirai)", "value": "ca6d53e53dedc745f842b0177314e051", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859992, "uuid": "e73114a8-a6e7-41db-ab18-780f317356cd", "comment": "Malware payload (Mirai)", "value": "adb2385fba3898d961f892bee173eccecbca0966f4af2d3122b4b88a13f27cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859992, "uuid": "97ea01d6-fb2b-4dea-ad98-cb8ab30ba10d", "comment": "Malware payload (Mirai)", "value": "ed55f9ff2f0671c73afa87b913e4bc6f42dbd91f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859992, "uuid": "819129b9-641c-4a5e-a2f0-67582cf5c6dc", "comment": "Malware payload (Mirai)", "value": "ad869925ab63ea6d52020f655bab4a46f26f9441e03dd0d5ea6d0e7f84ee820772a96d9eb5335abcf6653164bbd53705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859992, "uuid": "71099083-6f5c-428d-8fc9-0cb69116da6f", "value": "T17EB3AD9BF64B0590C86246F00BC34BAD2E1762118F67C5E7BC0E6A3D5A351DF8A16BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859992, "uuid": "915fa9e9-b2a2-4366-b861-da0edbe0413c", "value": "1536:sUQmwgbQZeCnyjI3FCtsKfCIG1S6Bgl0/LWFT:Xog0ZRycVcsBIG1S6Bgaqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769859992, "uuid": "9ebf5246-b2c3-4815-a5e3-4a27ea2bc351", "value": 107876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769859992, "uuid": "12e3dafb-3897-48c9-8eee-8f1e1094d74b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859992, "uuid": "e0e7ee59-2dc4-4763-a477-6677f01988cf", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974b5684-feb0-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1769869485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869485, "uuid": "4852cefd-ac2a-44a5-854a-81dc1a3aa42a", "comment": "Malware payload (DarkTortilla)", "value": "7c18eee37de273104221f90d4f0ce836", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869485, "uuid": "f0af38e6-dfb2-47ba-a5b1-a910b1fcbbe8", "comment": "Malware payload (DarkTortilla)", "value": "af45e7ab9d8c10b174c3ae27c54f39e69311c1716be6af42cc50eaaf96e29710", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869485, "uuid": "6b6294d7-15c1-4b6c-8e61-9ec82838d563", "comment": "Malware payload (DarkTortilla)", "value": "289c072ae8060b40ce8be5287d41ce1ea6294e8a", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769869485, "uuid": "b6a3c0bb-6112-4bd8-86f0-3bd5aacc6882", "comment": "Malware payload (DarkTortilla)", "value": "96789bad9a9d65b2898d0aa94620a4010f124dee2ed8d6fd6bd4e2a0cfcaf08a4a90e6a044314a9bac2a2d0364e6a9e6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869485, "uuid": "977df05b-0633-445e-a4ba-f01088fd0bc4", "value": "T137B5021B1AD345B4E4EADE34E3F945A842F46A2F5621A7BA264603F8DF1170F75032B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869485, "uuid": "75edace6-2b91-4b60-a593-912f48bf3959", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869485, "uuid": "c6c5141c-4083-4366-b5b8-1eabceb8eb3f", "value": "24576:eKfhYYNRHYm9Ph6WE4n54g8A5D8LoA3B/UoMOmxYC1xa7Rl7VL5h4gXTkZyPM2Ce:HTdPh6WP5D8u8LhB/rS87PWEPMc4+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769869485, "uuid": "9b0cf713-6fa5-42e8-9069-a0570ccc94e3", "value": 2406912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769869485, "uuid": "5a8e54ea-524b-4b0c-90e9-7aa5e10c6a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769869485, "uuid": "4e9a9b5a-89f2-483e-86a8-a961d1db671c", "value": "Quotation.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d194f4-fec1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769876866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876866, "uuid": "e097df72-a187-4e1d-8a37-7fac1daa8a6e", "comment": "Malware payload (Mirai)", "value": "bcf5bfb47f66b1e292294be0bd28d7b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876866, "uuid": "06b5f880-cbbe-4a15-a150-c8966e6c0082", "comment": "Malware payload (Mirai)", "value": "b0d77c1d7e6a4b76be8138e9fcc395f535d1b4e2237f46ffe28498f07d8080ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876866, "uuid": "7357cc4b-f7f3-44f7-8606-e87d7dc52a48", "comment": "Malware payload (Mirai)", "value": "ed35d6a70d4543f730db28fad2847f227bbf3592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769876866, "uuid": "4e748ae1-0ad4-476a-80d9-f5f6aca4c966", "comment": "Malware payload (Mirai)", "value": "5a93b20110d7347654712d9e6aa1321e4cb92edcbd86b6dc0bbf7082f08d8236e70cc97bae47946cc61fc813202078a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876866, "uuid": "5a7dad06-f0ad-43ee-affa-5bbaf53428cc", "value": "T188F3FA42B9418F16C1C311FAFA6E464D37132FB9E3DE7102DD246FA0378A8EB0A76655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876866, "uuid": "bb31219c-35b3-4294-9764-f9eb9de1fd14", "value": "3072:Wu4JOoteG/1WPtPruQTgAHAXYaiZ2gXOKlTZIRl9cP6hh1EGBmXn:WrUoteG/1WPt64RgXYaVgXCRl9cDGBm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769876866, "uuid": "191c4103-f0fd-4a08-b0fe-7e9fb0da4c88", "value": 171812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769876866, "uuid": "acfc90df-4752-4f84-b5a4-02df32ed5281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769876866, "uuid": "dd03b219-1185-42a5-9b3c-d6e5317ee33d", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc1d959-fe5f-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1769834544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769834544, "uuid": "45271f37-6975-4cd1-a55c-97c93d116364", "comment": "Malware payload (Formbook)", "value": "2ffe73c83a6895e79bd1501d305e8f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769834544, "uuid": "35e35d29-8704-4f77-a226-04d62e8df5d3", "comment": "Malware payload (Formbook)", "value": "b0fa29feb4da48f088d9e383d10ad8aef023efa91f6501142bb1f20749fd23d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769834544, "uuid": "d220fa43-792c-4eac-b996-99e3c615fb0e", "comment": "Malware payload (Formbook)", "value": "aded87d14abdfd7d05003fa448b41a50de706bb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769834544, "uuid": "5afed3df-5e06-4c86-aee3-275215d5a272", "comment": "Malware payload (Formbook)", "value": "1c952a30b2498bf516d15954fbe82d952d3bf35cade13b715d2316f4341bf757a57f6401cb4b92c61edb4d76298b2c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769834544, "uuid": "528bcff3-bd0e-4396-a4bd-be148f87f4d4", "value": "T1C625118527B8DB16C5794BF85972E0706B34BC6CEA02E20A5FC66DDFB43AF445980B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769834544, "uuid": "88869a39-0960-4687-b285-1cef71979c36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769834544, "uuid": "9a30290f-ee46-4ddb-bd9e-468436435385", "value": "24576:2o7CHHaZ81b/xCgr8k2sFOM94HUL+eIj2oGC+znvth:2bHaZ81b/xClXsFEHupOXGx7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769834544, "uuid": "15322056-d092-4f5e-9268-5cf13762b7dc", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769834544, "uuid": "7f8449fc-42f9-4063-8b52-97dd1ecd011a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769834544, "uuid": "af873815-cab7-4fd1-bd43-c93ccfbd9bc1", "value": "PreAdvseReportCMS2601517348178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac12fb90-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877680, "uuid": "a6753cd2-e19e-4288-be15-0abe63c4dedf", "comment": "Malware payload (Mirai)", "value": "af15f6e897087336b17a210d0a887078", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877680, "uuid": "8855d3b0-d3a3-40dd-a566-d8a54cd065d5", "comment": "Malware payload (Mirai)", "value": "b1e0eca2d77f3d2295c9fa4c44001fd9d4e48df7b10aa25b5cad01f61be9dda7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877680, "uuid": "00b3992c-67fe-499e-83f7-04eed280ad28", "comment": "Malware payload (Mirai)", "value": "ffa1b09ca5e7aae648dc1e0de91a77900b5491c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877680, "uuid": "8d7d03b8-c881-4841-a475-681d67fbe17f", "comment": "Malware payload (Mirai)", "value": "d3f6568aee0162f0b6978132a5908464d9d6aabd6c601ad8cfaeb304387b912475923ef5c797ffb595925496e63913f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877680, "uuid": "2d868cc9-3c04-40fc-a92f-35a2199033cb", "value": "T167533A0137684E07C1A65AF8292F27D4C3FFEE9020F4F684260E9B5A8635E37555AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877680, "uuid": "40ce9bda-1849-4b7c-8f46-0d1680d042f7", "value": "768:oZ8X1RFFI4TYtyHkM8R48RAmbZnR2dHu+rdA+P+yETuJPfwV7tO2XsN3PsGass8l:Pvr6lb5QrdXtIVpO26sGaloFGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877680, "uuid": "533913ad-2da8-4d41-b195-17cf5857f547", "value": 63076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877680, "uuid": "61e9b96e-608f-4884-a986-28a51258c23d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877680, "uuid": "26102ecc-2e2c-401d-9b58-500acd1f7a73", "value": "mao.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1228df3c-feb2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769870121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769870121, "uuid": "24b79837-aa51-4c6b-8ef0-0f92437518ba", "comment": "Malware payload (Mirai)", "value": "12d0c1ad2cadca4ba39e235b87290276", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769870121, "uuid": "af6601ec-5d37-4815-9be3-286d0f2958b3", "comment": "Malware payload (Mirai)", "value": "b2ac80b6474c14a27beac97efd6dce00c59f4da3b6cb9f059588de665c8f5e2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769870121, "uuid": "d3cd6851-893d-4e03-90a3-8a2799aaa80f", "comment": "Malware payload (Mirai)", "value": "7cfc96bb6570f7b4129d53a22c1db21ee12f5da5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769870121, "uuid": "5ea82671-ef4d-4a52-a7bb-cec0afa42389", "comment": "Malware payload (Mirai)", "value": "98d57f200241bd5ab28007d1d12790a5e90c518aba85935da292386df87fe1b184c1c4c191e1a547cf651cc12a38cdc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769870121, "uuid": "ae87e27e-8bbf-4afc-b892-afb5ecfc3c4e", "value": "T10E14B70A9F510EFBD8AFDE3346E90B0235CC650722A97B363674D524F64AA4B4AD3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769870121, "uuid": "c67e7dd8-c75a-495f-a8c5-a9d397cebc3d", "value": "3072:m2qhJ6XI0c0cHP8fufTPaBkWV2yxV6bq:tiJ6xcj8fWPtExAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769870121, "uuid": "c7626d06-c67e-42e7-bba8-a42099c0ae09", "value": 206456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769870121, "uuid": "9e7c52e8-6c55-41d8-962a-5b5b9489b291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769870121, "uuid": "f9b2153a-ba19-45e2-a94f-f16ffb4d30fb", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a669223c-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877671, "uuid": "e918fe77-ea66-4eaa-bf55-ca52498d3f51", "comment": "Malware payload (Mirai)", "value": "6f4760e98f21bce0b93357cda8d813c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877671, "uuid": "28739402-10d1-46fc-b156-8679f8101511", "comment": "Malware payload (Mirai)", "value": "b4811f5f075acbe9bda16a8b5ea29896ba145c3a8f134ab77adff8d4f2b419e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877671, "uuid": "3373588d-7eed-4b41-9edd-a7ba9227565a", "comment": "Malware payload (Mirai)", "value": "7cd89293a8d6fca929e0738494d7d768b78f4802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877671, "uuid": "bed0ac46-5ec0-4380-a246-3e94fdee827f", "comment": "Malware payload (Mirai)", "value": "9f55d4939f8901a995b2388d395531b79ebf83317dc0136ce309be14464638fce31ef384b21697e121f3577d12b01f94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877671, "uuid": "f133ec1d-1aae-46e5-b73a-3d2755424bc4", "value": "T102435CC8E59BE8F8EC050E312532EF32D9B6E53E2128EC97D7E96532ED85602D41529C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877671, "uuid": "93a78b75-72db-41af-a838-021a9bddcbb9", "value": "1536:eGVwqp/Tp8mqYH55NEvdnUE+xDv9AwAUeDbabkb1mYgIJaV6:Yqp/N8m9baFnUEYj9AwAU4aHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877671, "uuid": "2fbfd1df-ef27-42a9-8a80-457ccdc4372f", "value": 59632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877671, "uuid": "55ef2219-1be9-4437-ba9f-7d8c2d429e76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877671, "uuid": "14edce24-147b-4112-bbef-3e5d029c3389", "value": "mao.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47204b12-fe3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769819529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819529, "uuid": "83965c91-bc77-48f5-b394-238eaecbbe74", "comment": "Malware payload (Mirai)", "value": "ea6dd30edecc5e12eba29dda2251f369", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819529, "uuid": "a8823679-ebd4-4d29-954c-543b309731d8", "comment": "Malware payload (Mirai)", "value": "b534e3d3558aa6644d8a2fed139d6075a93be2507df2b389084dbacd6af2a657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819529, "uuid": "468104da-24dd-42a1-9a1e-8ec58a818697", "comment": "Malware payload (Mirai)", "value": "f4ad266bc9c3e5f14795ee03f1710294108cd261", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819529, "uuid": "7c3b00ef-c4dc-439a-9323-73908a74ccf1", "comment": "Malware payload (Mirai)", "value": "dd53151466c4f4a8a4cadf450a2d8d86242e2dd9baee378e1ba7f60c7a33def0eb8026b08f1c271f4c370d06fbfdb542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819529, "uuid": "4fbbeb78-7d50-40be-8c62-a5f2407dd510", "value": "T1CB330A96B8818A15C5D413BAFE2E118E33236768D3DFB2139E106F1477C696F0E7B912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819529, "uuid": "d0856371-4161-4624-9dd3-5d96139e9dca", "value": "1536:gdngEPU7JfjYFk8FGNYXGa7/oLRIxiYl94QX:2sFrYkVNlWLl94QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769819529, "uuid": "d1a42995-c09d-4fca-9719-96f85015194e", "value": 54400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769819529, "uuid": "1517bae5-8a7b-431d-9833-9061db2c4b35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819529, "uuid": "98160977-da1a-4161-a747-07c2efd65b13", "value": "0uparm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbe4c5b-fefb-11f0-a129-42010a9c0007", "comment": "Malware payload (DeerStealer)", "timestamp": 1769901819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901819, "uuid": "c4d8915a-8671-40d7-80ab-1d36f5830fba", "comment": "Malware payload (DeerStealer)", "value": "0017be2c052f09f5ed154aa0fb31ef6c", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901819, "uuid": "f9da322c-37cb-4f4e-9548-23903a48dd4f", "comment": "Malware payload (DeerStealer)", "value": "b65e358f50489d16259f50dc37d3f997990b699980798aa5430877603717ec5d", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901819, "uuid": "dc037c26-e48f-41a3-8713-27f961075331", "comment": "Malware payload (DeerStealer)", "value": "834e69f7cabebcdcb327e80e2d67e5c1bf0ac243", "object_relation": "sha1", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769901819, "uuid": "46c84b93-a18b-4e79-b67e-80abf4224e5b", "comment": "Malware payload (DeerStealer)", "value": "bbf95714c397156c4fa350d4704d4ac5d1a695af499cbda88ac6faf22e4a37a4e3958046e04685d96914e3fd87e12194", "object_relation": "sha3-384", "Tag": [ { "name": "DeerStealer", "colour": "#892807", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LAB.file", "colour": "#2DB075", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901819, "uuid": "46a584c0-da7a-4048-8082-2d68921a916a", "value": "T1CBB4020BF6E89031DC59877054E702C31636FE902B589793678FED5A28732B5B37522B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901819, "uuid": "e343f6ac-98ab-4d54-97b4-68627408ea61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901819, "uuid": "5ca21b17-b876-4ac4-a51f-f646105deafc", "value": "6144:KAy+bnr+Rp0yN90QE+IqHq7Lfdt3LmrXiQQRcrbtfc6sN+8UAsqFOqmu3Fe1uPx9:4Mrly90UK7rbhDc+6uhb8+DJXiQVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769901819, "uuid": "fcece792-cb3c-4f34-b2cf-d16a55f08df3", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769901819, "uuid": "fac41bed-b8c2-4eba-99c0-db13091f3fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769901819, "uuid": "0692139e-5ad4-44fd-808e-557fb9b1bab5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f467000-feea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769894221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894221, "uuid": "c4d664cc-aeba-4745-9a98-c783b8b73b29", "comment": "Malware payload", "value": "2ce80ac4c53afd5b07f77c3cf051f39a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894221, "uuid": "f119e695-7ed6-4870-9318-00c4fc2c258e", "comment": "Malware payload", "value": "b786eab9493139af005f5350e9cf29bfd2452f8af77e00a09b658b5d554eb8bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894221, "uuid": "be6b6907-6b13-436b-8e8c-d639e45dec51", "comment": "Malware payload", "value": "19788dcbc367fba214ec2f5dfa4a8033d3db1f11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894221, "uuid": "0c2fc5d4-1610-453d-8cbb-78fcf6c6052a", "comment": "Malware payload", "value": "ab24d5782deff9c0783be293bda229923dce45889596ea08ac8b655ea337040342e722575d373fe0084b784fa0388e1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894221, "uuid": "73110042-c495-4c9d-84f2-58b6e353394a", "value": "T17D92E030998B9430C7B02D3E9D7CD986A3E36BFAC2B63119D41EC58C1DE55142FB5ACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894221, "uuid": "79ddad71-7b96-42ff-95c1-5e6e1eebe2f8", "value": "384:k1pQpxnItDnBHYYRsQvHDtFOCOm4aJFXSFunhymdGUop5hUgkk:2uOhBHRsQXOaXSFuns3Uozek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894221, "uuid": "bc86f1d1-b665-43ac-965c-fb9bdebbfc4f", "value": 21087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894221, "uuid": "fe677081-733b-43a3-9291-c0a05596822e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894221, "uuid": "cdb3740b-7aa0-4623-ab9f-11786766bb39", "value": "ssh-agent-auth.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a024a579-fe98-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769859192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859192, "uuid": "6e4088b5-3b44-4cbd-991e-ef3beffafe4c", "comment": "Malware payload (Mirai)", "value": "ea06167acd0193e549c213ff7813ca4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859192, "uuid": "606e7422-4e1c-4151-88f3-adb6ed2ddf92", "comment": "Malware payload (Mirai)", "value": "b7a3af59ee5db48d17799334c31d2fa9e6c819ea0f5dcfea3e10f689808286d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859192, "uuid": "5a0b9b88-9ea2-409e-bf4d-e0b99ff88b3f", "comment": "Malware payload (Mirai)", "value": "7dedea74c3cc0c2241bbe7c8972cb43be9174f9e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769859192, "uuid": "61a92c7f-41fb-4103-9815-93cc51a1243b", "comment": "Malware payload (Mirai)", "value": "1f02554de1163dadc99300759075244fd8ca76de2e6c89c051c3e6d1b7fd80b5c903f9d237414ece9d75bc55948ba2db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859192, "uuid": "c3ce611d-1fb0-42d6-8bd8-446e7b7d8d84", "value": "T13B5165C6534A1E302CA3AE13F6F6452831C2D2A26CE5AB99EDDCBEE4434ED343142753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859192, "uuid": "71350d06-9886-4260-aa98-2de01f1fc21d", "value": "48:vK7J7N7hKM6GKg0zPK8KWKOoUK7O7o7UKff3bKZ9RKycgKFpVK0SOKg+CKvfTK3U:vK7J7N7hKM6GKg0zPK8KWKOoUK7O7o74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769859192, "uuid": "7c78495e-13e2-4d52-b695-fe005ee6f212", "value": 2910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769859192, "uuid": "024bda30-685d-4123-a245-26fca2ce1533", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769859192, "uuid": "f0e3043c-0a51-458a-98ee-528d2f7fea94", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec242d6e-fe7e-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1769848152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769848152, "uuid": "87904340-37e3-40f7-8a15-9c1f87d88f2c", "comment": "Malware payload (AsyncRAT)", "value": "a8c72a84691fe09d5b3d2f6ca8722ea5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769848152, "uuid": "7dc23674-dc37-4e49-8666-77b51da87b74", "comment": "Malware payload (AsyncRAT)", "value": "b8520187ed07a5cb95074111acd6179523fb97aedcd0b156432f7691fcbfebed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769848152, "uuid": "eb4be7d3-3519-4b34-a205-43eda8bd7944", "comment": "Malware payload (AsyncRAT)", "value": "4ab64fa677a9fb7bc15573ca2820c9c99a6bda83", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769848152, "uuid": "d941dd6c-52bc-4f23-be59-82d1f0ed2ce0", "comment": "Malware payload (AsyncRAT)", "value": "4f189953547eabe6318a00e396ec27c3d4992ad6a6f4898d1049ca567554b48fa25486ad9f3df3660bfc41d4540bc849", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769848152, "uuid": "74131626-8746-4c3d-9ec6-be1dd731b0a3", "value": "T1E2D24B08B3D48562E1FD57B94C7293048775EA5BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769848152, "uuid": "ab73229b-0b7e-4a43-92fe-82518f6cffd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769848152, "uuid": "cb3a5e91-38f3-4f58-bb59-5c766003161b", "value": "768:UAMRXpZrm+iUg/cIRGqom/Rb7fB/dTL/+:/MRXHrm+iF1i4RbN/Z/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769848152, "uuid": "ed663db6-6077-460d-9e01-e2860f203d06", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769848152, "uuid": "165cf5c5-0ab9-4066-bf16-cfeee1f39ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769848152, "uuid": "f65da32e-e760-4a53-8753-19cec0d3504e", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79f027e-fec3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877673, "uuid": "904debe5-325e-4df5-9281-99b99c41c45a", "comment": "Malware payload (Mirai)", "value": "089270e8188d77f4d970d2dce67e8b52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877673, "uuid": "30fe6d45-d8ce-402a-8913-e1c7e73d43c3", "comment": "Malware payload (Mirai)", "value": "b9373f4df561e2be8ec80117331d22d9efd546c9d51865b66743a69c77ce8121", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877673, "uuid": "92bf8f20-f01c-42c6-9870-c1f2951fc512", "comment": "Malware payload (Mirai)", "value": "f32377f889747a81cfd7d3bb2f17478017860aee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877673, "uuid": "a071c99c-5450-472c-bf39-ba1f9c1ebe4f", "comment": "Malware payload (Mirai)", "value": "70f0f1d6e19fdc9c93b5ee6a9de39e179f5053aebbf46ff518c87fbfe785ec51f98f87b50539bc7bbe724b21bd7c3e2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877673, "uuid": "dabfcc98-14fc-46d0-8cd6-f653de79b299", "value": "T1149317781945F3ACEAB65074F40365E62A5206183FDCD2E36D87247BFF34788A56CE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877673, "uuid": "edc739b9-898f-4baf-a5e7-925c63799ea0", "value": "1536:JhMGEQliBx31o4ttBsmAMIV+k6IEVBIVCCfy0K9mTZkF:JhEQlipzTOMIX6utu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877673, "uuid": "5e699d99-4dbb-49c4-bf8d-069445ad30d2", "value": 91916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877673, "uuid": "e9d914b5-61c9-4407-8a8e-912ac97977e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877673, "uuid": "fe6e5a96-2cf4-469f-b7f0-67bafcbdb470", "value": "mao.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34324690-feea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769894229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894229, "uuid": "75587497-ee9f-4fc1-80bf-975f1fce4537", "comment": "Malware payload", "value": "d278c52e2c07fc7c650e840d9b12ed52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894229, "uuid": "a5c3e08e-9de3-498f-a937-189438569c40", "comment": "Malware payload", "value": "ba8032128c7b747c47dc2f777a45570935a368beec93f5f3e1003773a7bb450c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894229, "uuid": "912515a8-9fe5-4852-8ce9-326b7062b492", "comment": "Malware payload", "value": "82e195352ef4b70512272343a145a21c493fa5b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894229, "uuid": "627e779a-3a2f-4e9f-b132-44e4e0bc213c", "comment": "Malware payload", "value": "0c891053690603674894ed3e0904ef9d1e1dfd667f1475d24b7befa0a48170e8cbab494563005e99b518095ce02cea5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894229, "uuid": "9e6841ff-0b9a-409b-a42d-c93c87984a3c", "value": "T12C03F1733FE93988E3B0ACBF5D71040AD57903FCE2D931B936624342FAA104546EA682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894229, "uuid": "2ac8058c-35b5-4ce1-9535-66582cb36d6f", "value": "768:2gcI9lAHkX5wabWWK0iDKI0csoH46wa4cs7ldYc7pTgdNss3Uozg:PcrkJHbWWFI0csR3cEfYc7pTgJzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894229, "uuid": "3274a09e-7841-4ca2-ac9c-eeedc9318843", "value": 37819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894229, "uuid": "57ddc250-4a4d-41f9-8b84-15d1ca468a35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894229, "uuid": "8705cf70-f2a1-4116-9639-15eeea7f1836", "value": "ssh-agent-auth.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd51713-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877200, "uuid": "5590f880-9faf-4c8b-80c9-475d562084b6", "comment": "Malware payload (Mirai)", "value": "a14b76119ad1f8335dd418cdf8913e55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877200, "uuid": "901371e5-a228-475e-8c5e-9b34375a4b62", "comment": "Malware payload (Mirai)", "value": "bb673fee82ba897cdd610bee644ed823384007cdd4121ab87a1448fcef1bc161", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877200, "uuid": "fb5cc4fb-a249-4e2a-96ae-93f2da979358", "comment": "Malware payload (Mirai)", "value": "da89032d61305bfe12ed79c771256e71d264abd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877200, "uuid": "1014388b-fa43-4527-903c-fb7d20fd9d70", "comment": "Malware payload (Mirai)", "value": "be7c2a4f21a85339ee8bd77865ed8b2446f9bf8436d1101c5e6f48ff43aa589bd164d8e0bc984f415e65196f808033fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877200, "uuid": "b4c1bf2c-664e-4d11-926f-9984101cb46a", "value": "T1A3A3A448F968937DC7E172FFE35507CE733A0798A7DA3625AA3542166FC5718B834220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877200, "uuid": "37f0ce69-35fc-44da-89e9-cc0899234d02", "value": "1536:sQbM5Cbyt4TRtn5u8xdPIwJrGYouOnNSDyJK6m1QipKyxGLM6nAKWy:TgN4dt8UJrGYouOnNlJK6DAuLf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877200, "uuid": "55f88287-3b94-4ca8-9932-51199885f0b7", "value": 97989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877200, "uuid": "c3343b57-b070-408b-bff5-76bec50c137a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877200, "uuid": "035c8604-ce8c-488a-8cb3-55a7d074c2dd", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac5cfd9-fe71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769842406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842406, "uuid": "ae4b30b7-3b54-4809-9401-65caa1e4deed", "comment": "Malware payload", "value": "9c825e753720036c46c2b193b7035b82", "object_relation": "md5", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842406, "uuid": "42c31a44-fb1e-4ada-aaf8-887481d406cc", "comment": "Malware payload", "value": "bdcdab45753934652919651a64187351480215b5f3d4d1f9272af7c2b8bd8147", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842406, "uuid": "22d33c82-2f84-4ebc-b59b-20475a459b47", "comment": "Malware payload", "value": "cbae13ad403ab07d2bf7cb53fec2956366e12d80", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842406, "uuid": "bb71a006-dd4f-431b-b129-3e5620d20d93", "comment": "Malware payload", "value": "f98273578989251b1e111140c79647118edbf9d1b2a12bcd8ffeccb258aa25c3a6abe3744a098c6c5f5f478aed61aefd", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842406, "uuid": "c858db5b-f596-4d92-b49c-40f09a054f03", "value": "T1C6E53315DD2CCF5E35BB03F8286B567B21D655C342612EB2B43648BBB0B804C9719AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842406, "uuid": "612144b8-fb83-4fa3-8b92-e090936d8aeb", "value": "49152:HN5M5iOGJCkLZXNxe9jex4gvOvfi7lF+C/5B6OEVoDFpeq6LAAuDXEP04EfA:VO0b4jeGZIlFF/57D3eqyAA8nfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769842406, "uuid": "33ceb6f3-8a17-48a5-b594-602ab88c8c53", "value": 3070682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769842406, "uuid": "9bd1bec0-fcdc-469f-952f-b88abf930e85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842406, "uuid": "75ffafb2-9f73-4119-96a0-230f0e99241c", "value": "bdcdab45753934652919651a64187351480215b5f3d4d1f9272af7c2b8bd8147.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e304150b-fef6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769899677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769899677, "uuid": "20561c41-afc0-43bf-bd39-eaa6f143b12b", "comment": "Malware payload", "value": "aa8bdca7334e278960cf695c51b2db80", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769899677, "uuid": "31647440-eac9-4b7d-84a3-908f1bba79f1", "comment": "Malware payload", "value": "beb4df6a60740b89d43b296b97df972e00ab1b501c7908dfa5e23bc0d8af7303", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769899677, "uuid": "35afba81-247b-4e3c-9b63-1b7540b25af5", "comment": "Malware payload", "value": "29fc40e46d1a74ed565b15247dec35cece61c4b0", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769899677, "uuid": "b349d163-d613-4786-969e-e6a818f70891", "comment": "Malware payload", "value": "a057ba865883ea0d6914aa2f775bd3c5ad28b6916e8805d1ce658c9e17ca646f04fb187f0c4c1ab6a494ff7d17e0c192", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769899677, "uuid": "b9b65beb-94ca-4a4d-9ac8-775cf7bf1219", "value": "T177463AAB32E88179C11EC23FC4A28F40D4F7B1B50737C6E702911768DA668D56F7AA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769899677, "uuid": "39e76953-ef94-46f5-b1f7-b7f9319e837e", "value": "07fba07802e4a95408526be16e22b7fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769899677, "uuid": "0b8d4d6c-5340-4e78-afc9-bf299f1730f0", "value": "49152:elfUFv3+WavCTC1DtFSPzsSxuB8StMAnJuwyeAvTAbt:4xqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769899677, "uuid": "b77a3afa-3236-4307-9289-b9889f27227a", "value": 5361152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769899677, "uuid": "2abc663d-52cc-4d70-8a96-65d93015795b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769899677, "uuid": "22a2926e-9a23-4a4f-8dc7-a3fe7deaf53d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cde07e6-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855589, "uuid": "8ade30ab-9d94-4ab2-a06d-d5cc5ea57b84", "comment": "Malware payload (Mirai)", "value": "5f4deceae0220aa6e5635f21ae29b588", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855589, "uuid": "f5c0e25e-b18c-4c7e-979e-89d88fa147df", "comment": "Malware payload (Mirai)", "value": "bf4e6b97cfd213b4d6142fbb10c545317aa46c63a137b4253cad806427abb072", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855589, "uuid": "00f87cd4-cc8e-4327-965e-2dc103f165eb", "comment": "Malware payload (Mirai)", "value": "8e8e7058da486a4b181dc86f64b774e2f964bd7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855589, "uuid": "8667e39f-9e7d-424d-90cd-c8a5583a1732", "comment": "Malware payload (Mirai)", "value": "f85174c1cb96734d10cd0c606dca39f00a2ff8d4ed0ff0944d1d7f679b44352bfb913b96643e839aab4f2e9e09651137", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855589, "uuid": "fc3a03b1-9fe9-41f5-9dfa-7e9b621e3adb", "value": "T10093E551BC82562BC6E423BAF6BE668D336577E5C2CF722BC8214B117B8551F0C63B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855589, "uuid": "5cddd4ba-e621-4947-8f89-7fc8e2811875", "value": "1536:PWrd+dC++zBz/dPXQL0u4WaJuLaVlW04brj9uYpMNGY2LYghn:PO+d8zBWLac0yMNGFlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855589, "uuid": "734aced9-7f45-431d-b7f1-5f460374e67b", "value": 93804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855589, "uuid": "ce62bce2-e731-46fc-b259-ce435d815ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855589, "uuid": "ef06a21c-a42d-47eb-bf57-6be69a2bc3ff", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961c0c3c-feee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769896112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896112, "uuid": "4be8402c-f733-451e-b468-afd153a47605", "comment": "Malware payload", "value": "661321de43e1f9ac7b8f835fbe8e7443", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896112, "uuid": "bbb46c0f-96fa-40b9-80c8-7ea1dd5628f5", "comment": "Malware payload", "value": "bfcc51383c4d80e555a1f8ec8e6298faa2e63c6421e520b630af3af4fe2a78d5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896112, "uuid": "a65786e5-794c-4e96-84f6-75acf49efe72", "comment": "Malware payload", "value": "b36cc8c36d1201d90d117ceaa20fd503831eaa7e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769896112, "uuid": "80a07ffa-6d8a-4ecf-a77f-7921d7059942", "comment": "Malware payload", "value": "1e49f9921f41ef5142ccf1e667507a1eb5e1033368795d20b9ff512abb69775b41e73000c8241a5574b24f6105cb99bf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896112, "uuid": "1d919ad4-be4b-4c38-af29-5707a287a19a", "value": "T1D1065C53B288A53FE06B1B3F583BE670583FB6602A1A8D0B6FF4195C4E396406D36747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896112, "uuid": "953de147-5812-4f3a-9294-bddf99a8e84c", "value": "694e3de35418ad5a678b52378cc688f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896112, "uuid": "00a27bf1-d878-46f1-8764-b829638a5dfc", "value": "49152:s6xuvrC5Zv1AHNrFcS44NfAtRHIt/gXT0PoC4sVyErOta:s6Yr+qtrqCdgA0ErCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769896112, "uuid": "c32250c4-ba14-4d63-b47e-2b769a1a061e", "value": 3715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769896112, "uuid": "e4f41b62-3559-490f-89e9-060b8a494a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769896112, "uuid": "84e60c34-cab5-4923-a84b-aa015c924ec5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f201d686-fe9c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769861047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861047, "uuid": "c74c93f5-af3b-441e-afc8-da2faa01770e", "comment": "Malware payload", "value": "7118dc27750700fd890e6c76a07a3c6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861047, "uuid": "e7ea37fd-d2b3-4cf1-979d-b7881abb4aed", "comment": "Malware payload", "value": "c126a83d1def8e6458bdb92216892a0500984a979346676124c12a4b2dd4b41d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861047, "uuid": "52ac758b-268e-404f-bae0-dfe817d21c20", "comment": "Malware payload", "value": "d0747664fd5a7075b794e6ba964953e8a44fbb7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861047, "uuid": "b76a0242-ccf6-4567-8e23-e45cab50d2c7", "comment": "Malware payload", "value": "77ce55fb66dd8db72b25732789a579e8712f50a5169571eaf5ab4386f5ede8a301fedc25c717606db3187c2c10675de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861047, "uuid": "b494d724-bbe1-4cbf-ae7a-804a524794a1", "value": "T1FBB40210B0D19175EA7619B208A4B9D89F2CFE300754D9D7A3C849EE4F315D0AE36EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861047, "uuid": "34aa5dd6-3d9e-4f47-9e49-569f0d7b01de", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861047, "uuid": "f0d08f21-7681-45b7-a569-f147487c3b4b", "value": "12288:lHztGhqRHMlFMuSxKzG8PkYO33C/8+/vyeVHVvBc:buKsxSEfM+l116", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861047, "uuid": "6df579ac-8ded-4204-bd6c-8f308da26410", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861047, "uuid": "86413d4d-7b8e-4d47-9d5b-8d7072d74cda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861047, "uuid": "e41d4a96-6115-4a70-b643-d4e7a793d848", "value": "7118dc27750700fd890e6c76a07a3c6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67500bf6-fe73-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769843205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769843205, "uuid": "2ab0137d-f1ad-4592-a738-31cacfc0f221", "comment": "Malware payload", "value": "5ac0f092ab5bd161e41223d3a2241b12", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769843205, "uuid": "0eacc248-a87f-48ca-8a85-1c029699ca36", "comment": "Malware payload", "value": "c1b6222ac56428f20da72236d9a7d62cf7424c8e93335e995e5600bf412e90d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769843205, "uuid": "92ecea99-f65f-4ee5-b60b-1c6eef9b36e0", "comment": "Malware payload", "value": "530a58288b2429f7d45925a67b23d24bd8460df2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769843205, "uuid": "e215cdf3-e71e-4510-adec-00a651d641e4", "comment": "Malware payload", "value": "e2f63917540db4e10b5a38c04457d4e594b9a79816499198e10b1138141bc121ac775986a37812d3e29e1069bcc2b6d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769843205, "uuid": "a4065eb6-b273-4bb9-bcbb-d812b266dd42", "value": "T153E3E8402AB25B34E2BD05F67432025A407597C791D19E1BDCE2ADD63FCBACE1063AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769843205, "uuid": "2de493e7-9a85-4d12-8b7a-56d1e08a3b07", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769843205, "uuid": "a9220c98-1e3d-4abf-b14a-1d188461ad0b", "value": "768:2Zz+/EiVKg0t5FvGVqoGZqIY3zCwYlaxxI:az+MIX0PHo3ztYl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769843205, "uuid": "680ea997-127e-4f18-95a5-7d9ba6157969", "value": 143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769843205, "uuid": "15cfc05d-fe82-423a-81a0-3c1ce93d7921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769843205, "uuid": "e8e4d416-58cb-44c1-94eb-ca49517d4956", "value": "malware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3218f79d-feea-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769894226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894226, "uuid": "2a77d30d-c2f0-4a96-a624-479cfdf653aa", "comment": "Malware payload (Mirai)", "value": "50bb657927a25d465a603585b883ff2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894226, "uuid": "4ec58f64-9980-4b81-9739-5dcd46d425a9", "comment": "Malware payload (Mirai)", "value": "c1fc75d7e279d839d8762c174a29f40f38a10d4f21e01d3a1a1881d3b407fe56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894226, "uuid": "ecaf4db1-8bf6-4eaa-9df9-18e1ee2fa349", "comment": "Malware payload (Mirai)", "value": "edbb807c2ae69656c877f3f86382d0a0c4c7f19f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894226, "uuid": "7d3aec90-be2e-4fe8-8665-7d991b0527e4", "comment": "Malware payload (Mirai)", "value": "a93c2ddeee7c005bf068b55370ef4c63d7c3748ef68ea3d2ed7901839b2197d7456e0744472e7a0d5fae42ecb1842800", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894226, "uuid": "1d930afb-1b3c-41be-8d57-7489e27f9d15", "value": "T15803E1630367EEFCD49796FA5F0E54C8FA0660266202673F081072FDCED67952B68781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894226, "uuid": "b1feee1a-1925-4ff3-90ae-524e25b9696e", "value": "768:2byQKr/7RHeBIh155aws3BS4AW/LlERRsAq3ROkSAVWbFnx09Y:2NK77xwk5UwsRtAW/LKqBOknWpcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894226, "uuid": "be9bcfb0-058e-4e55-97b8-da5d58c527c4", "value": 38939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894226, "uuid": "eaa03162-0ec0-42f4-a7cd-da30c284d6a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894226, "uuid": "85b69804-c11b-443a-a4c0-27e05ef8368e", "value": "ssh-agent-auth.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18545e5-fe89-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769852886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769852886, "uuid": "3a47cc27-39ef-4646-9ae5-42d89c7c1cad", "comment": "Malware payload (Mirai)", "value": "8e81a4dd9e5b1e3602797e1e58f6132f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769852886, "uuid": "b5b2ab5e-b0c4-4b01-b52e-67b4a51eca1e", "comment": "Malware payload (Mirai)", "value": "c2bfd7d6c63f75221613204744040186ccc374bef5ab921e4bc1f7ee0b4ce3c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769852886, "uuid": "9a22a93a-df4d-4d50-bdf7-4cfcfb6ef634", "comment": "Malware payload (Mirai)", "value": "1b54fad41d6dab723c8c453bb9064e56e911e4f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769852886, "uuid": "7229ea27-0f70-414c-85a7-52ed3d39785a", "comment": "Malware payload (Mirai)", "value": "b129639481b76ffd795b3ab1bc1cc900741d8c143608c932cc8c2d3d41ce2c57a374b4c1495e21291e2d5a316539fb4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769852886, "uuid": "9e5be2a0-4bb6-4ca1-a64b-696f552690ee", "value": "T1CBD47D59FE5E3C42E2D7E3789E4D83E1B32771E4D32391A33982434CD5CA9E98BA1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769852886, "uuid": "77049894-2a8f-47e6-aaff-5c2012cc97ac", "value": "12288:WvAZ94zuyRM0MzSnsF0l9wDFxDcReZtbIDnCzhH1yWw5nzUZ1dB:Wv6CzuyR2U9wD/DweGXb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769852886, "uuid": "c9755fd9-ac99-44b7-b24d-acee60588952", "value": 644320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769852886, "uuid": "0ed33f89-7c42-40b4-b0d2-c10083cedba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769852886, "uuid": "399db7f2-765e-48b4-93ce-28707d545d21", "value": "data.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab4d55e-fe9c-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769861062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861062, "uuid": "d94c3572-49ab-46cf-a1e2-5291ebf82fba", "comment": "Malware payload (Vidar)", "value": "f72b7f2598fa51d05bc460027607bc9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861062, "uuid": "4b7f2426-7cdd-4f69-90b8-41e4f283983e", "comment": "Malware payload (Vidar)", "value": "c3cf0bd8fa3d3f27853901744158b70223382d9b5f5c1d4578f3f4316743db81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861062, "uuid": "dc25d28c-cc90-4612-8baf-309606d8555e", "comment": "Malware payload (Vidar)", "value": "e46e77f77f0dc6acfebe6753b1d56442dde818ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861062, "uuid": "95e72506-0b87-4db4-97fa-1622a09dafd5", "comment": "Malware payload (Vidar)", "value": "4a413ca786562e057a7508908ef198d946f53d355c4f459030e9669a886d15bd22d839122ca22b71755d2313ca8168a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861062, "uuid": "ebb0e664-bcc9-494b-b745-84c8d6237597", "value": "T1A9362913BC9949A5CA7FE234946263527731785443313BD32EE9296A1D2BFC42B3FB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861062, "uuid": "272039b8-9457-4114-ae45-70879765961e", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861062, "uuid": "84e8d178-efdb-4ff4-a323-fe74428790cd", "value": "49152:HLW8+3chUQqYbxkyHtV2RobaVMPOabMV2sXoRyTvuV/UmQf9C4wDdHe0JjRF48mP:F+3I5beyjROhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861062, "uuid": "7b998f7b-b8ae-4410-bfd0-6e15b9f65cfb", "value": 4911744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861062, "uuid": "6df2d1b4-1a49-4ed5-af9d-5eeecc15ccfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861062, "uuid": "85074f0e-5068-4950-8ddb-73c7ce1d4c84", "value": "Bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95b650a-fe39-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769818405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818405, "uuid": "d3212c31-2b81-488f-8690-ce3103b286c4", "comment": "Malware payload (Mirai)", "value": "a6b8b2e4920c95ee346fcea4c22abf10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818405, "uuid": "7b754e33-b272-47cb-acb4-59ce15f0a853", "comment": "Malware payload (Mirai)", "value": "c42b628b050a3f70e2b9ee3382647f8a7cd729542631bd2e3ea064ad46b71c6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818405, "uuid": "8e0d1a72-c9a6-4b87-9016-0d750760ae0a", "comment": "Malware payload (Mirai)", "value": "bf503c0b641582dc15f5d7f149c2fef45ad221e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769818405, "uuid": "0e3c8c0f-9536-4e4f-b491-f98bdc0f0a08", "comment": "Malware payload (Mirai)", "value": "ee239704e31acb3fdaf93589727118be422c58b8636512b601031dd05583cf31e30068e1634b61788a9516f294896c8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818405, "uuid": "7d6b988c-2261-476c-8083-43b180769858", "value": "T18083179ABC85C702C6F0A1B2FB1F51CE37164368E3E6B157CD19AF29674B8970A37211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818405, "uuid": "47a8b00f-5494-40d9-ac8f-67b00ea7722e", "value": "1536:7D8CfHZ1PCqNh6pVaP4aQiRVoz5Gn2r514xVFybvxX:7wCPLVcp1BiRVY5GnFxy7xX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769818405, "uuid": "052c525a-2acc-4ad6-b1be-f8fdb212dcf9", "value": 87580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769818405, "uuid": "79003332-fee1-4d2b-a2b5-6bd8cbb79b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769818405, "uuid": "a20d54f3-63ff-41d1-aea9-68729db6bcea", "value": "zerarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7275d4-fed4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769885034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885034, "uuid": "f4e7c46c-3eaf-4df9-a0fa-48c13de20ef1", "comment": "Malware payload", "value": "db10edb9f5ecf508299c4f254bb796f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885034, "uuid": "79e53a21-9fd1-441c-87ee-c823e4996686", "comment": "Malware payload", "value": "c5963076fcf838297d24c2c09487c5e54f03cc612906be0e02bf7cb74c20f8b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885034, "uuid": "0f776f5e-27eb-4c14-a17e-36b87d71463e", "comment": "Malware payload", "value": "9d773f6735ef9f2694bd4ed27bc21af45b91ecae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885034, "uuid": "dd8f023b-ae8d-4a8e-bb4d-878ff8dff107", "comment": "Malware payload", "value": "c0175e385f4f7d092783b0c59ca6756139de76be810300e93f6bbf016137f6b9d0577611a6f430fdccd936e6afd52d93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885034, "uuid": "e5092920-c5fc-4c2d-ba5d-da3754a4c55d", "value": "T1EAE32A45FD419B16CAD662BBFF4E428D772B1768D2EE32039D256F20378B85A0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885034, "uuid": "6344e835-01f0-4d22-9f1e-14f100435c8f", "value": "3072:SaWA82wcGalUssR4kVSgO5AnGh4F0TbmaQOoMLEEijVW:WA82wWlUsIBY2Gh42TbLQFeERjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769885034, "uuid": "a94afd00-d1db-4c88-b19c-a0cece7ca90a", "value": 150296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769885034, "uuid": "e322ec4d-c37b-4e8e-b79d-d1f18712b5a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885034, "uuid": "ea63ddef-a43e-4e4b-a576-d9b041c2efa0", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cad9df5-fe82-11f0-a129-42010a9c0007", "comment": "Malware payload (Nightspire)", "timestamp": 1769849603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849603, "uuid": "63be0ccf-4c3a-4115-9895-5071d2483e01", "comment": "Malware payload (Nightspire)", "value": "94dd3315fca4c31ef61b7865c3b8983f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849603, "uuid": "ee9b513a-bf01-4bce-8fdb-4f3aded59b3f", "comment": "Malware payload (Nightspire)", "value": "c5f526cc62688cf34c49d098dab81e24e4294f832ada57433ef505d5ac6da8f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849603, "uuid": "75f84bf9-2b84-4073-b956-5cee98dd4337", "comment": "Malware payload (Nightspire)", "value": "f5da096e2ae6079c4670ddd6566244618056a22e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849603, "uuid": "babf3d93-e878-4aee-bb4b-77ed4f2cae66", "comment": "Malware payload (Nightspire)", "value": "7f274faf1ac0fbf6d663a9a0bb4c9f4e660143e11f1bf5d428b3385095e17d490352f839175b58d0f0c92fa4ec38d610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NightSpire", "colour": "#1B04B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849603, "uuid": "5a32a888-ac4d-47b7-82dc-9f0bf6ebcee8", "value": "T18BD54A17FC9669A6C0AAF23189629152BB61BC483F3123D32B90F7782F737D059B9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849603, "uuid": "8726e0c7-3d2a-4b1d-9f23-add4ce124487", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849603, "uuid": "080057d3-0c1b-4b73-826a-2a1968465add", "value": "24576:w84YNAYoXEbDceEcO8/7dFrLHtIw0eSXAGzWg8w+3HH7Nx51KxK9KV/GG9Mtk59K:w8nNAYDceE58/JVrt9Eb01KxK9KV15E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769849603, "uuid": "3457a8d1-8b81-4893-9010-78c81ae03298", "value": 2999808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769849603, "uuid": "db6ae5c7-5181-440c-b005-5b0da7e7d933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849603, "uuid": "557a2f4d-58c7-4ab6-b77a-dc0ee8b26d09", "value": "c5f526cc62688cf34c49d098dab81e24e4294f832ada57433ef505d5ac6da8f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c47570-fed5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769885396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885396, "uuid": "e898e61f-c90f-46a8-be1a-4d4535e9a43c", "comment": "Malware payload (Mirai)", "value": "d01785ca85daeb832b64100dddb19e6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885396, "uuid": "51fdde27-38b6-448a-bd88-68db066313a4", "comment": "Malware payload (Mirai)", "value": "c6e28aa60c4e9a85f248a8ee4763efa357a015215a1216226cebffbd7a154043", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885396, "uuid": "6d9c160e-f1e9-4a9f-87f6-030fe63f8888", "comment": "Malware payload (Mirai)", "value": "0955de8c0522cb696a9d47b46a104cf2ecb280b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769885396, "uuid": "61d109ef-0dfb-41c0-9cd6-773ceeb0d9c9", "comment": "Malware payload (Mirai)", "value": "3361100b6afe1158a3b9b71a773d9da4745daf0b7062e67b08be722e3e06662347b7a471da9ff2afa81597a824ff8a2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885396, "uuid": "f5296b43-c7e6-4aaa-9991-277ee7c5e44d", "value": "T1DCC46C55F8809FA1CAD529BAF65D929C33070779C3EA720799245B343BC78AB0F3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885396, "uuid": "f1a778b6-0324-43a8-836b-19705870e4ea", "value": "6144:ahxQUOzpZnwWQJNwQHlec21htsR3e4XpIv58JKaVrcYUInsXgEgvgpuor7RKi:aPQ5nQr6WXpy68+Uqswfgpuor7RKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769885396, "uuid": "13c310ae-843e-4acd-9d55-c911256604e0", "value": 554412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769885396, "uuid": "26621e42-203e-4a13-9dd4-702a2cbc11a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769885396, "uuid": "25d90046-f37f-47a9-843c-2fac4f7857c4", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b75d69-fee9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769893828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893828, "uuid": "e7e6634e-3e97-4e5b-a42c-e50d70c74f67", "comment": "Malware payload", "value": "731d00f84d4a27e71709941b8f77fe6e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893828, "uuid": "64611dd4-35f1-4e85-98b6-b569073c7e86", "comment": "Malware payload", "value": "c6f803c1468193c54a22608ac6ff545fcead6788e95d759fd30525eae9b6f67e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893828, "uuid": "1bf1fb3d-4d45-41df-843f-301f4b5b68fa", "comment": "Malware payload", "value": "0515c4bb4dad5f7713f4ac53dd63e20e85e550e3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769893828, "uuid": "9848727d-da3d-4037-a99f-1d0c0c4bf3cd", "comment": "Malware payload", "value": "85b1232e0aeaf45422b49a577d86973d30d7f6d370e61a2197d0fd223e2fd26f6f47c47d30a37621d80dafff77b955b7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893828, "uuid": "49b8cc4f-6f48-4415-8a1a-68046ba90424", "value": "T1AAF53382C15AB0B4E65463B63F99670D931B3C92D43EB60C33E8097DA97A0B7891F357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893828, "uuid": "d620b374-44e7-4922-8702-af4a39243369", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893828, "uuid": "318caaf5-f4c6-4e33-bd09-4f7fc4b12fdb", "value": "98304:Mi93Sd46N59FLBGioPUMFoAgf3H08V9k7/:lSd/9dfoPUMFWfX08U/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769893828, "uuid": "6aec18fd-dd95-428d-a198-9fa09821009e", "value": 3501419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769893828, "uuid": "197e7770-b6c3-4a22-93c2-571c4916b385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769893828, "uuid": "0d52368d-3915-4489-8ec0-122035234bbb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7203091-fea8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769866156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866156, "uuid": "8d1e5017-3c89-402f-bda4-dc08c5a1aeb7", "comment": "Malware payload", "value": "9553a2167b70539234d178c5f8d3bce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866156, "uuid": "2a61a988-e0b3-4265-a2c7-34b2c370002d", "comment": "Malware payload", "value": "c733a9293f2f3dbe2a6681c3dd8c814a2bb22a7561e98d8194f69b82fefe7134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866156, "uuid": "1d912f68-2306-46c6-9d89-438ac53f56ed", "comment": "Malware payload", "value": "b3f309c0a83d5e3ef513e239e89ca5d595e1bc37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769866156, "uuid": "2f5999a9-4db9-41dc-a97a-46d5dc01945d", "comment": "Malware payload", "value": "5ee02e0973bcb7692465b70b6681945dc18c376751a607fa805815a1700550b01d2bf20505cf83058ca4d099ad8681e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866156, "uuid": "7a1d563e-05fe-41fd-8c9c-b07a355d5057", "value": "T1EA95F106126AE621F27F437A41B0894043F89903ED92CB19B6D8BDD35DF3399DB1927B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866156, "uuid": "66ddf63f-7c67-4e2e-b8b0-c47e51f324e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866156, "uuid": "884d9018-6994-4ba9-bf64-106b623e69fe", "value": "49152:IVee4SRDppP4v4AFa9xW21Pw8kNBeJ41BE+2Ofvh3VDayw7weJt+U5tyromuNZTr:I74SRdKwAc9xW21PyBeJ41BE+2Ofvh3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769866156, "uuid": "f59199e4-0314-4ef0-8fea-aeb62cb6169f", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769866156, "uuid": "9b4c796a-a437-46fa-83a8-4f40108b73f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769866156, "uuid": "9b023435-5832-45ef-8545-7d2bb00803ac", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.41153.32336.843", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470cc628-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855606, "uuid": "428a228b-92d0-492b-9cf6-203e3e7c9bd2", "comment": "Malware payload (Mirai)", "value": "fbc50b9ffef6628f435097f1a7da56fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855606, "uuid": "2644c4ba-1225-44cb-8146-1550055f5cc6", "comment": "Malware payload (Mirai)", "value": "c7be5e463b411b6378485474dba265001316fd57840b6fd35f02cb940e8cdf8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855606, "uuid": "c78c12f1-1a5d-43cc-8f0e-009e5b8a28a1", "comment": "Malware payload (Mirai)", "value": "35726a5ce87f1d27bd12bd22243d67040e2473e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855606, "uuid": "9f9b9d02-5605-4c30-8d4e-16dbf52607ef", "comment": "Malware payload (Mirai)", "value": "ef16f9ea8a61dfde4790b741e5ef4bceb9ad81e81df753497e0493dce90ef8360fbe09d103413633b410de7f93607c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855606, "uuid": "0bb01b01-2642-44d1-8f4e-7720253c573a", "value": "T163E33A55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855606, "uuid": "3807605e-e4a9-4563-89c7-8aea571156df", "value": "3072:8NMcOPLZDozjefDoHwreWu1gSa0lI7TEy6KuImk4:IOBozje7oHWuOSa5F6K4k4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855606, "uuid": "f0dbc7e0-c07b-4e3b-86f8-301cb263f244", "value": 145552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855606, "uuid": "dfe2bd34-857c-4fbf-b3f0-e79bd45db291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855606, "uuid": "9c227863-e6fe-4f85-983f-803c5ee81e3e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a9b1b5-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855601, "uuid": "74c34814-e57e-4ad9-80c1-a3b3f2e36afc", "comment": "Malware payload (Mirai)", "value": "4f82e9c69a344df5059fbd484fdaba7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855601, "uuid": "6c6f5921-a638-4260-b798-5745af02637a", "comment": "Malware payload (Mirai)", "value": "c8640f732a1783da9a80b709546b2a2462f306f9d374e8ca2aecd02170c4b895", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855601, "uuid": "8ec310ec-51ba-47fb-82b1-235ce1894090", "comment": "Malware payload (Mirai)", "value": "9b7dee66a90260e7b695eee89fc2409373cfc0ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855601, "uuid": "7f254758-9974-43f6-9947-4bd57cdfcce1", "comment": "Malware payload (Mirai)", "value": "5488b66fe567b9d3940872e2cf20bc5f99bd89b0aef63ddbe7c92ad68855c233f3c213c2dd66b055c93715f362f6ca2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855601, "uuid": "c2b8dd68-0f33-416e-8527-923c0de7f721", "value": "T17EC32902F98584FCC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855601, "uuid": "c9463ec2-806e-4967-bd6c-8d476ce49890", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7Beyr0Ez0zQxAdojgaR/3:eH3TghM/1weZbcnITeyosFAIxnJdhgJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855601, "uuid": "7bcaecda-2939-4e14-ac19-3c59aebfcbe5", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855601, "uuid": "c63518d1-2d8e-49d6-8a3a-b060274a76e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855601, "uuid": "5d483991-e1f9-441f-be3d-39ec30d1e193", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810afb21-feb4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769871166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769871166, "uuid": "6bc67a62-5fd7-444d-80e0-7c97f2806d21", "comment": "Malware payload", "value": "99a87cec2ee06d1bc977fc198e11bec0", "object_relation": "md5", "Tag": [ { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769871166, "uuid": "108e47c8-cbf0-47d4-bbd1-0b73b95100d4", "comment": "Malware payload", "value": "c88f2448efa77d4ba9393392cc48af741ef1a700701fe26607f9d577fb840a37", "object_relation": "sha256", "Tag": [ { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769871166, "uuid": "440c121b-c356-4e0c-b253-064838ea1b73", "comment": "Malware payload", "value": "6c33f6d7547039e67e0a848bd54e01662b7c51a0", "object_relation": "sha1", "Tag": [ { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769871166, "uuid": "1c8d3af6-13da-4dad-8d1d-214f36dd765a", "comment": "Malware payload", "value": "d3568553d16657685e7a06ea20338f2600677c15cbf9d8c6d31d3f60a62cede8c0072597065fa2161b013e6406246d84", "object_relation": "sha3-384", "Tag": [ { "name": "Etset", "colour": "#804365", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Etset!rfn", "colour": "#00BCEE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769871166, "uuid": "a0580bfc-e21c-4c53-b2e5-d1d423d0fd42", "value": "T1C9D633E6C36408E5C44CE2F07D4E447A9ECE9430E3915AEE69DEC35FB912DC867325A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769871166, "uuid": "9069819a-3a21-462c-802a-30844e75ceaf", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769871166, "uuid": "9b86afcd-6d35-4f98-9a5d-274732353197", "value": "196608:WLwDRHLdAYmCDIuRk5XSiBoSCsJe8vIIMJytSivX710S4qJH+:pHOCDIuk5FNw8wIW+rvl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769871166, "uuid": "6e777c1e-6fe0-425b-b17a-ad92e7e249dc", "value": 12807680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769871166, "uuid": "6464c318-4417-4cc1-9273-7b1c8e393231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769871166, "uuid": "61a5bb6f-a259-4739-ad17-00bc920b584d", "value": "aaadddbbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d214a58e-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884616, "uuid": "e565673c-2247-4260-9329-126900b012af", "comment": "Malware payload (Mirai)", "value": "9ca7cea8189390ab58e5184095d12c96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884616, "uuid": "27e4c0de-a80b-4640-8f26-79296ea0a8df", "comment": "Malware payload (Mirai)", "value": "c8ca7fe3b27cdc9a39b43a7fb203d75c31c0cd7456d2bf46b5b84c9bdfa0f3d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884616, "uuid": "025c0021-ebed-4746-9090-0288cdd9dedd", "comment": "Malware payload (Mirai)", "value": "5ac47906387626be83e5cfce06a228e78a5fee04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884616, "uuid": "fc4ac777-8fa9-46e2-b9cc-f8ef59207948", "comment": "Malware payload (Mirai)", "value": "d69d146d5737fdc61e48f50f4ad0fc279f637efb1ec0942f4604bdb3a6796c778a20336f72bceb2e882e68c7c07141a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884616, "uuid": "22800395-dd3d-4fa2-a6d0-de4afc317c62", "value": "T106E32B56EA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8679F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884616, "uuid": "21fb31eb-ee72-42ec-8a65-64b39684ccfe", "value": "3072:eJLce5p0pHdWSEaaHbz4NrA/Jt5IQ1F9kXMk/M/983kY:eJLcHJEaaHbz4NU/JrH9kXMcM/9IkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884616, "uuid": "b2d974b2-930a-4027-b2ff-0a11e62b8996", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884616, "uuid": "856675f7-33f4-4148-99e5-96e4b24e1ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884616, "uuid": "edc606ef-f84f-4a6f-88fd-ce3a5e698328", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e396122a-fe9f-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1769862312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769862312, "uuid": "0e98a935-87a6-40b9-9a51-554e0c15a307", "comment": "Malware payload (ValleyRAT)", "value": "bee5b0ea86a61182fabf0970c5aa5678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769862312, "uuid": "4744491a-8e6e-4cca-8050-f38c54aa015b", "comment": "Malware payload (ValleyRAT)", "value": "ca04e090471a92350a6b6a3636b7a850036408b989cebf2ff314ee564c0c2419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769862312, "uuid": "c2d93e23-8b7b-460f-9f43-9fbf903333b8", "comment": "Malware payload (ValleyRAT)", "value": "14c77f8c63d5ebeadfde160643395ed973fca2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769862312, "uuid": "7dc09fcb-518a-4fd8-8c61-3d155e9d3918", "comment": "Malware payload (ValleyRAT)", "value": "a743a55dd074b054e4f92e4a5cf8d2fb90724533f6bd16906a9472cc66cf080e84a2d483648335a3f312c10b9c711466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769862312, "uuid": "372b7ff0-44db-4622-bf09-18c0f04428ba", "value": "T1F3E36B00B1E1C0B2C46A19311875FDB18B7DEEB80E745ADB73A8B5BA5F701C09539A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769862312, "uuid": "863cf1ca-4d40-4920-9b6f-9bcd2985b463", "value": "d84628f77ed10fa1b7a060d11d5b8e22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769862312, "uuid": "3baad0cd-dad4-4256-aa28-2ae427369772", "value": "3072:a0YIFF0jC+avSxdxpsI7Aag3vp+Gy1ADsKKT3l/PiXnUrs70769:aYL+PIIMa+7ylK1Urs7Q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769862312, "uuid": "5e2d4724-4209-4c2d-8ef7-b9a6d748f9a8", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769862312, "uuid": "bf55a116-4e88-4006-8b2c-c6f243bf94ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769862312, "uuid": "35e27303-67bc-4fa9-80bf-fb143d085fde", "value": "ca04e090471a92350a6b6a3636b7a850036408b989ceb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bc6f29-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855603, "uuid": "3ef56cc5-bf5c-4c5e-99ef-85b6c3ed93f6", "comment": "Malware payload (Mirai)", "value": "32e249ef91e35875280e7318b91de04c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855603, "uuid": "ee856079-5d59-4531-97e7-26b52704955f", "comment": "Malware payload (Mirai)", "value": "cbc7af0ee6fd7db292faab8ad06436f830f05d5beeff4f03d72d98741b680485", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855603, "uuid": "c78df6ed-1db0-4a9f-8459-6573a5e448e3", "comment": "Malware payload (Mirai)", "value": "623ef3f3c3970ea2c716d80c9ebec45a1a91a87b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855603, "uuid": "8df8535e-d364-4c0c-b3e6-9b52f9d26b79", "comment": "Malware payload (Mirai)", "value": "b493dc9b83d9af8a20ec3c552be6bf355ce9d5a2bd3dfbdb2cbe9e393867b38a5e43132ba26ecbc3295995ecd907387b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855603, "uuid": "142f2d4d-74e2-47ba-a137-6d588e23290a", "value": "T1C8B339C1BA43D4F5EC1641306177F73B9A32F0791239DA87E7A89E327C92A419D0A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855603, "uuid": "b28c2906-00d0-4098-b9e0-81192385b3e7", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wtzSr9bMFfl3:Pbj4doYGFB0/45gdd9ul3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855603, "uuid": "226a3fb6-173e-47b2-9449-7342334b40a5", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855603, "uuid": "57d040ab-585c-4c42-8b91-b637b76cfd36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855603, "uuid": "d6400d47-29d2-48b0-86c5-b36234e785ca", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9316db-fe9b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769860448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860448, "uuid": "2ff396ef-b2c5-4f26-b8c4-a7035cc47b5c", "comment": "Malware payload", "value": "19ad66240acdeee338254a5f72ab2341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860448, "uuid": "c157ef75-0dfb-4884-92ef-2ca40798a543", "comment": "Malware payload", "value": "cc4df93d84243c83047a3e76f65105e170ae789f056f8e313b5aa93407764e87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860448, "uuid": "49d38bfb-5cdc-4c7e-837b-05c4b6b5eef7", "comment": "Malware payload", "value": "ffa5f48ef2d3728964ea27c86d4573f047fd01cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860448, "uuid": "48d83485-8f3c-46bd-80a5-394f57d6a37c", "comment": "Malware payload", "value": "d9158c72ebdb1093b8c5413effd21910f90fbc22637b994e9d67f71c7ab4d4ff7f9b245d8837e34b13547c9983f8efdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769860448, "uuid": "910689f9-2a26-4044-a4cf-cf8c5fe9cef3", "value": "T1A6D2F11EC4A8ED93C65E6DBDE48C0B768D49B84673192E128351870DEF15E8B5F124FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769860448, "uuid": "5213d7aa-b52b-47a1-9267-cd1f924a0054", "value": "384:wn6Ppdqf3I54hJulN7s1kByqDN2FtX4n4UAkKm3oEK4glwSElPzWs38uXsPzNRWj:u4YuDs1kBBZ2FtxdHJMTSEd5rXsLbWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769860448, "uuid": "b8437f2a-a6b6-47dd-83aa-842723367322", "value": 30745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769860448, "uuid": "dc2e6d92-52fb-4302-a64d-072fc3778647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769860448, "uuid": "ba3d9974-b2e4-49fd-b422-cb849f36ffcc", "value": "xans.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac5b43a-fe3f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769820877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820877, "uuid": "947b8108-a5a3-4366-a8cb-67c37e339379", "comment": "Malware payload (Mirai)", "value": "1d667a779fc9ad68166b232277244f71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820877, "uuid": "00571a25-fcd3-42f1-b938-14ed8b9f3b90", "comment": "Malware payload (Mirai)", "value": "ce824cabd9911052e09cf8c32b3bb77ca9502221ef1c24b530a01402204d7edc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820877, "uuid": "fb4a0448-5297-4290-abc0-e6798b2a3bb4", "comment": "Malware payload (Mirai)", "value": "e877eaddbafc27251069b586969936c173627e43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769820877, "uuid": "f41f91ba-0200-4dae-8d36-f5a9d465c0ea", "comment": "Malware payload (Mirai)", "value": "835a11cbee3b751a4fbbba1005231c90ebaba0c6f072fd47a15739e09879167ae63aed1d2328175645cfa244a069d9da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820877, "uuid": "f84dd72d-895b-46a4-9fe6-a789a42c6860", "value": "T197F34A47EF890FCFC45BCEF046BF43AB19E3959B9CC1A2F0583C8818795919A49D3A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820877, "uuid": "78104132-659e-4198-be2c-b52df00e130a", "value": "3072:ggOeKR7qgoSWpZTQ+/uZsuiwqLgcA81TfzshZQs6qJ:1+qgonLHusuiwq0cACohZD6qJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769820877, "uuid": "dc40c81c-8507-43b3-9d32-9fefe6841edf", "value": 172056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769820877, "uuid": "e3a26dc5-a30e-4718-ac7b-c3683a62afd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769820877, "uuid": "228d1ea8-7e3a-4acd-808c-4ca8a0f21798", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7374b21a-fe8c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769853963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769853963, "uuid": "a0e8f5b8-4adf-4484-8510-f5790a7e836e", "comment": "Malware payload (Mirai)", "value": "b6cb9e456be4c39576998c212e3b8ffa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769853963, "uuid": "24676cf2-01bb-4682-a05a-9b446e9efea5", "comment": "Malware payload (Mirai)", "value": "cea21250ad646120008cb9fdf028bfa93da1cdc908fcad9ae7f7b82732cf9db3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769853963, "uuid": "7ed9dcb6-f7d2-45e9-acd0-4e16ee9177eb", "comment": "Malware payload (Mirai)", "value": "30701f89dbbefcfbd8754570ed9245b44b97cdfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769853963, "uuid": "d6342b8c-7238-40c0-b202-7a224ffbd41a", "comment": "Malware payload (Mirai)", "value": "6070d975b137af1e71d174025a66caba1e2f174583eca1f9cc88c309b225f05d53288f666f615783db07490259afc5f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769853963, "uuid": "b1a4f464-9e6e-4e86-a7af-17787de6f476", "value": "T1E2F45B02EF890FDBC4AFCD70456E834717EDC9D706D4A33451BC898CBA9E66A4AE3458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769853963, "uuid": "09fadd5b-93e2-45e4-bc34-e5bfaa089af2", "value": "12288:p3V3aI/gLuA9e8N5JCym6exuzYhnzuz0zTzNP/9l1siu8bA1O2G5+VGAQ5mB7quZ:hxR/6O+m44wSwY7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769853963, "uuid": "764f788d-9fc2-4a6e-b06f-660f15e27bf1", "value": 730636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769853963, "uuid": "ed44c0da-dc8c-4132-b704-d73e3077acff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769853963, "uuid": "08a37a71-5dca-4620-84ed-adf0edcdac5d", "value": "data.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89639db-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884627, "uuid": "9d061457-7d09-42b2-bce2-22205f753ae3", "comment": "Malware payload (Mirai)", "value": "da4b90edbea8be38133b776321967a3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884627, "uuid": "4ce1693c-413f-4745-bfe3-e8d9a5c24615", "comment": "Malware payload (Mirai)", "value": "cf8055aade9f00af7e258271dd9e2ceae54574acb9291d6b8791f26afd387834", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884627, "uuid": "079eca0a-da37-4dcb-926c-b28da07258e6", "comment": "Malware payload (Mirai)", "value": "ce41854b14f066210654270610f626ea696a951a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884627, "uuid": "cdfa83d9-534a-42a4-bfd0-a8352ed0d2fa", "comment": "Malware payload (Mirai)", "value": "0d8fce2d2f5755c9eeee90f38f594ee8e77c18ce46a37cc7804a57f9890bf0f9b8ef056625c551039fe7d983d5956c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884627, "uuid": "3c45e5d3-0ceb-4acb-82d6-136b2816cde7", "value": "T16C330952B88145A9C6D047BA771E978A336363A9C2DF7353DD0C0F416ACA70F4EABD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884627, "uuid": "80eadd3b-876a-4746-b9b2-f7e37d4f70ab", "value": "768:32YY8ay9aQ8tD/TVWPysgDUjDroGhNTjdXM4v2Fr0nSz:32YY8v9qvUVXjPPhNTdRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884627, "uuid": "1fc6bb27-851a-4d3a-9526-1da6b7a1bb47", "value": 53672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884627, "uuid": "7cc7fea7-4592-4559-9d50-d418de5f7527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884627, "uuid": "26d348c6-b7e7-4867-87aa-9e3c195654e0", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a9fcb1-fec2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769877289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877289, "uuid": "ecf249f8-e716-45e0-ba4b-3bfde17f0151", "comment": "Malware payload (Mirai)", "value": "1a2ecddf24e2040e1e72d1b373dcdc62", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877289, "uuid": "7085e2d6-3696-4778-a7c5-fb0babdb0db3", "comment": "Malware payload (Mirai)", "value": "d0e064c4cc6ea3015ee06a5374b7a5d161c142b6a90afc2b67ae9a355743aa91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877289, "uuid": "71b7fc4b-5cb1-429d-bc18-75343486641e", "comment": "Malware payload (Mirai)", "value": "12951c43612094852a02928dd4328b7a6dbb8257", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877289, "uuid": "1e78b661-1151-4469-8181-2d148b104cfe", "comment": "Malware payload (Mirai)", "value": "cf97ed0ad0c7c8634f9899c3a648a24b087bf55c5cdab59d64a05197de361cef0934893823d8587b421b5ae8a7ef25a5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877289, "uuid": "bb81c3c5-178b-4aec-b449-11f0decb55a6", "value": "T13111EBC771E061F28878CFCFB6648884918881EADC5A6E38B4DC992B44EF58CF454771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877289, "uuid": "368ddde9-a4c3-4aee-bd3a-4a4a7e4c5d23", "value": "24:ssYoOJrsYtfbYsYRsYnB8sYaNI/sYKsKBsYxqsY2KpsYGJsYV3c4h:sD1rDRYDRDB8DXD5GDED2KpDiDK4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877289, "uuid": "6b860a3e-a02f-4652-8bff-65ab54a2cfa4", "value": 901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877289, "uuid": "152234ea-5b04-40a2-ab99-1b4ec2322011", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877289, "uuid": "23dec1b3-8604-4ed1-adca-22a1dd4fb1f7", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b6a5f2-fe85-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850764, "uuid": "850a8645-284c-4d5f-a93e-8b2e29e3e4df", "comment": "Malware payload (XillenStealer)", "value": "486cd180da8c3c057849bafdc4a3fb1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850764, "uuid": "aac0ba55-6a8d-4922-a6f1-8cf2b4ddfb03", "comment": "Malware payload (XillenStealer)", "value": "d135c2482bc384d3878863d3e87b0e0f078910fa6ce17a93db0e0f899366a5b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850764, "uuid": "3a7beb6b-97aa-4d29-a88f-2e686eadb1a4", "comment": "Malware payload (XillenStealer)", "value": "0708d70e7850488ba07da41d3740ed910beefac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850764, "uuid": "0e2b9d4e-af4f-40a5-a0d8-24b13b3921ab", "comment": "Malware payload (XillenStealer)", "value": "964ba4e63e8300547b24f9df1adf71e8f1da668fa05ac95ca73bc5132463edd22660713cd8f05ae36ebc916208d95ec6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850764, "uuid": "9c180de8-af49-4acb-90cf-a30a2644ee4f", "value": "T147853391586A8F1DC196B5F30BF1C0CE794D52447CE261AF15CEE7D8D0AA4286EEC0BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850764, "uuid": "f5ae7498-2c4c-414c-9efa-86a1dfde8754", "value": "e0a2c0168120df22501a39283b15736a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850764, "uuid": "73ed5afc-4c02-4668-a6c7-0fe3ff3686da", "value": "49152:BFoJJmyUxk4tCIPi62tXhNn6vMpseZ4kcdlAqZDitsc:BJ1xk8CIt2txN6v5TkcxDiyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850764, "uuid": "954db1e3-2718-46cb-9872-a2fbf1d3cba0", "value": 1778488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850764, "uuid": "eac6f569-b332-4420-b03e-e9a013798fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850764, "uuid": "4ff178aa-a95c-45f1-bb3f-a7246afca38d", "value": "testpanel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e85384-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846723, "uuid": "ffb9fe8e-5538-4bd2-8e5a-e9b6398735be", "comment": "Malware payload", "value": "9c7c9b47bcbfcbd3fdc06d6b13310bee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846723, "uuid": "0a1c4273-4773-4066-8daa-1da331efc87c", "comment": "Malware payload", "value": "d43722e3c852ed18137c8dd41c1da7d6ccae6f6913c7850a66cc5982fadccdc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846723, "uuid": "698b605a-aa63-4e48-954b-e68847c711b0", "comment": "Malware payload", "value": "33c304ddaf9e32fd7554768e0198e8414acea22d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846723, "uuid": "0d366b54-617d-446b-925b-b8469cbe4f63", "comment": "Malware payload", "value": "cb57e02fc6a43de394d22962f949be41553a3849a840f60d2e47c330b02398f7f156a7887a9303ae6a7ec89074c476cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846723, "uuid": "9e00e67d-834c-4ce1-8b6b-e5d6241cae3f", "value": "T12F955A43F666C0E8C56AC4B4C74BA633BB22B889073179EB57D44B243E56FD0663CB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846723, "uuid": "37aac6e5-9baa-4c9c-a8ee-243381c48e81", "value": "3ada7d04d65fc3b1cd9d70eadeefb1bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846723, "uuid": "dff5f574-4523-4173-a983-8da2c1ef0bea", "value": "49152:9uD6dEYjf27+JiFlRXL2SJp7b7dVrU51J4K4IU6i:Tl27Q2SSWpH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846723, "uuid": "b77c81eb-eda8-4c07-b9ae-d0bddc7374b4", "value": 1920000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846723, "uuid": "f0460b65-6086-4b3f-8701-335804b19886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846723, "uuid": "5c8d487b-19fa-4058-87d6-8c205ebf6c9c", "value": "d43722e3c852ed18137c8dd41c1da7d6ccae6f6913c7850a66cc5982fadccdc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6afbce8-fe81-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1769849432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849432, "uuid": "5be655ce-b8e5-470d-ad81-bba6cae3e476", "comment": "Malware payload (Amadey)", "value": "1f74371acabdf0a6a83ec3884723d6cb", "object_relation": "md5", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "anti-evasion", "colour": "#1D71A1", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849432, "uuid": "964c8107-c817-4ab7-b8b7-1c946bbc6a90", "comment": "Malware payload (Amadey)", "value": "d44cf4f3954be46e830fb90868e7f741aad5c4681efd79a26462d936d661d2dd", "object_relation": "sha256", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "anti-evasion", "colour": "#1D71A1", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849432, "uuid": "e234fdd2-8ac9-4ca9-9088-0beea3907fa1", "comment": "Malware payload (Amadey)", "value": "108624fdc1e52f38738db0c87389621336e45434", "object_relation": "sha1", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "anti-evasion", "colour": "#1D71A1", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849432, "uuid": "0731a128-c618-42ef-999c-629e51de8580", "comment": "Malware payload (Amadey)", "value": "31924f66ee0011912c5f2699611bd68d1ef1ab843b3913349a00663f0d6ac892a56437b73345ce026b3b23f7a98a2ed5", "object_relation": "sha3-384", "Tag": [ { "name": "64bits", "colour": "#5DCD35", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "anti-evasion", "colour": "#1D71A1", "exportable": true, "hide_tag": false }, { "name": "detect-debug-environment", "colour": "#8180AF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "long-sleeps", "colour": "#E092CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849432, "uuid": "c3bd0861-d75a-4ab0-a3e2-7bb67e674059", "value": "T18423F806F29320FCDA5782F844D76BF5F123BC15003B5FBA9295C6352E21E519F6D82A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849432, "uuid": "e2c3660d-b377-4212-96f4-65721f8256e8", "value": "d1c311f16b68466920729bb5d4cd994b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849432, "uuid": "3f4030ff-11aa-43e8-b5c6-04e55b822a6c", "value": "768:XW6FI1HJx8o5JEln/etqiNNJlkwxsiYTKNtCMlL6kmBaxOLCjddf:XDFsL8SJwmthNJlkwxs/TKNtCMF6kmBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769849432, "uuid": "c500a485-a840-4ec1-af59-3475e9505973", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769849432, "uuid": "0253606b-23df-4124-a0fc-518ccfcd31ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849432, "uuid": "b5b8eb15-ab95-4c78-919c-45ab121a1ec2", "value": "storm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c30495-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855596, "uuid": "e84ac865-9aa8-47cc-b579-b206362e8717", "comment": "Malware payload (Mirai)", "value": "01337221c208ca1901823204b8291cf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855596, "uuid": "ba6c6f12-cde3-4f2e-abcd-179ab3bdb177", "comment": "Malware payload (Mirai)", "value": "d466d2714c0f203700c50f463423868f54f9040eff52dbd75f48bc7362fdf056", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855596, "uuid": "ed87d3e5-ea4e-444b-bb46-adcc6e99a2f2", "comment": "Malware payload (Mirai)", "value": "abbeece3d346c0d795e89a54744501835ea25690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855596, "uuid": "28e549bc-e75c-4815-98e5-0e9ee6654f88", "comment": "Malware payload (Mirai)", "value": "9c69a8b776a8aa15c7ee753508fc5b350b4b7e3a528d33dfb7e96c8e55dc1ac7ccbd62cad7a3ac594690529f97dc1399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855596, "uuid": "74c71353-9268-4793-8f0d-2dcd59ab19b2", "value": "T19ED33851B9829A27C5E123BFFA6E018D332563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855596, "uuid": "f02f21fa-084c-460b-bd57-fb347a36715d", "value": "3072:snFif7apx6XS+kUgpjWXQQKMs0u29wzulziQSY:sn8ZS+dQWXQQK5s9TeQSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855596, "uuid": "fd315077-7f78-4017-9ce3-928bc01972af", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855596, "uuid": "d488b404-dd05-47bf-b6af-ff15a30edc2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855596, "uuid": "1566327d-4ae8-4df9-b23c-30349810051f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1522fb5-fee9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769894090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894090, "uuid": "4ef6776b-c088-4255-a6b4-03760e81ecb2", "comment": "Malware payload", "value": "9871eb6360a45bc89f37007e07283940", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894090, "uuid": "7b7eadfa-9154-4dba-9118-e9e1f8eb1caf", "comment": "Malware payload", "value": "d6094e60d369617adc2129eaf39fdbd7503e4f4a0382978c62c38efe1257cfea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894090, "uuid": "6ba462b5-a4ca-4cf9-832f-343e62b6a3b2", "comment": "Malware payload", "value": "de46f47c287e5b93e3373fa61e05926262969e78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769894090, "uuid": "e8290472-8a2a-4a49-8bee-15f12455ee7c", "comment": "Malware payload", "value": "fabce0d5afa78eb8922ad4cd85c8aebbfb6047341991fab808357f123cea0c95a31a8f6e34f7073b68d848694fada58f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894090, "uuid": "cd3ed01a-4169-4fd1-b592-b42e8de52dce", "value": "T190F2E132E5158DF8DA232E95AF5153C2363586D0B68D1EB3900B8E221F330767309FBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894090, "uuid": "a599434e-687d-4fdd-a047-2808edad9adb", "value": "768:hj69teBHYYZJcqFaSulaYDqLKFdE8UVntGi+26SeFOSWiyKSYJO4uVcqgw09I:Q9IOYcq31OF6ZKTjSkzWicYJO4u+qgwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769894090, "uuid": "581d5cae-bdb2-4ecb-aec4-456cd432b61c", "value": 36983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769894090, "uuid": "ce00d650-3378-4523-b075-28fd3bfa0cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769894090, "uuid": "d6815da3-e8e8-426a-90fb-12dcaabda3eb", "value": "ssh-agent-auth.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b51e7b-fea3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769864063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864063, "uuid": "10c21d72-3fd0-4c9f-a6fa-9981d4bcffc4", "comment": "Malware payload (Mirai)", "value": "0fba8e44fae43282c6688dfafe5e8215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864063, "uuid": "e450d420-8c07-4c03-9a4a-c3c2412e59c2", "comment": "Malware payload (Mirai)", "value": "d703ff95bc0f1332b2ea4938a2f769f256a58dc3c6ce6dfed0dd8687c7d1b338", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864063, "uuid": "5011e873-4d37-4f4b-ab7f-911094c9db89", "comment": "Malware payload (Mirai)", "value": "25523ec16c9e7110cf06d671d36fa4c8cb25f209", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769864063, "uuid": "3c267e56-0de2-4e9b-b5bb-fa0cd97a0b65", "comment": "Malware payload (Mirai)", "value": "ef10263cb5f5f0e737a04006caebff7442d061e135d5418dd15f48daab8f93651d953f122f8affd478652ade36cf0831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864063, "uuid": "0b157eb0-68f1-4929-b33e-e0fc16100e90", "value": "T1B2B30946A9419F11D4D631FAFBAE414933536FB8E3FA7101D9206F6023CA9DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864063, "uuid": "f75b76f2-4fef-490f-ab78-55df600fa6a9", "value": "3072:gTAq+qVRG5xuaWp2va+FbR1TFCV7Pfj0g0wqmFASf:gTAKO5xubAva+FbR18V7PR0iqSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769864063, "uuid": "bb182bf0-23b6-41a2-82cb-9e67bb4afc3d", "value": 110392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769864063, "uuid": "43707253-f635-4b2a-8487-b4d468cca32b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769864063, "uuid": "c0292dc1-fdbd-47d0-95ef-3dda2f501411", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34893d33-fe71-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769842261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842261, "uuid": "6730efbd-1afc-469d-8721-a31bb9b29008", "comment": "Malware payload", "value": "5b0baa7fb8b7431046bcdead344845d3", "object_relation": "md5", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "homepage-hotel-reservations-com", "colour": "#31E879", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842261, "uuid": "2815f8f9-3f74-404f-ad59-9c9c4bfa59fc", "comment": "Malware payload", "value": "d7a3b5c8370a3b1546f92461aca8d6a85a8e391b78288baa342617c52cc17311", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "homepage-hotel-reservations-com", "colour": "#31E879", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842261, "uuid": "4bf3fd07-d26a-448b-9728-5ec9f55c3989", "comment": "Malware payload", "value": "afdad5caa69031bac0d4838a497fdad7175d1582", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "homepage-hotel-reservations-com", "colour": "#31E879", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769842261, "uuid": "769b4145-37d0-410d-b0e3-3195e660bddc", "comment": "Malware payload", "value": "497cbddd62103348fcb962203769fab3b3bd8e0f6f4f74f0a7b5ef49a7be3f3c9467acb7f6c14e20d5d5557bda29ff62", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-131", "colour": "#A005D5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "homepage-hotel-reservations-com", "colour": "#31E879", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842261, "uuid": "e677ce25-fca0-4cad-bd3e-d9a99c445ef8", "value": "T1F3266C49E34000E2C9A7ABF6BDE31962E574D111C71557B86889C32A63DB6E40BFF4F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842261, "uuid": "028b9ac0-a28c-4f08-9b16-fd000d0d7016", "value": "2c9c5138db65224d94ae75afcd29b2b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842261, "uuid": "4030def6-f8c3-4971-821e-fa83c25f41ea", "value": "24576:zWEpKOTmxNP8ZBrSoArrWjC4/b6S9O81YGu31p2zKC7KB0yhk:PpcxN0So5dPpmfDO2Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769842261, "uuid": "3870750f-8178-4b3f-9266-8e0e4ab4541a", "value": 4737024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769842261, "uuid": "ffacee27-2d3b-4135-85e1-532ff50e9d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769842261, "uuid": "5f8bf89e-21af-43de-9467-31a9b801ab9c", "value": "mscoree.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f950f4-fe83-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769850182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850182, "uuid": "5fac9e02-0f3a-4eec-82bc-fd44b7665bc3", "comment": "Malware payload (Mirai)", "value": "5c6e5c9f15e3a691c196a149ed628076", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850182, "uuid": "de2fed5f-8b4c-4106-a435-06ee1b6e4635", "comment": "Malware payload (Mirai)", "value": "d81907f731a7d823f653e2be6cd77af5367ae51e725e7a536c0e7ac577cb3e37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850182, "uuid": "2484a618-5589-496e-abb5-6ccd1ef2e93c", "comment": "Malware payload (Mirai)", "value": "8a54de70d9972e0cd5c9368e76851ee6cfd8bd16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850182, "uuid": "2a8b55e7-302f-4bef-8a50-5f1fb3f4f23f", "comment": "Malware payload (Mirai)", "value": "5f243bfb21de5118379bd599e1551e90aae5148ee4fbae6ab493990fbdbdd1920d2ec8f318fbd0262b2b1e30832b2ce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850182, "uuid": "6e64a119-fa5f-431f-af6d-8600781bd974", "value": "T136057C88E7C6E0E1F67300F1065EEBF64534A12A5023F6F6EF45276774327A16F1A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850182, "uuid": "daeafbfc-61b7-46d3-ad58-8127937e021d", "value": "24576:s2WP0LxhIuhoen4DZmro76TYeFNdZZVax:9xhIuhoeaZp+FNR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850182, "uuid": "c091112d-3bae-489e-9c98-d3cdcf15b027", "value": 861816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850182, "uuid": "e60f2121-9348-4a8e-8238-9e33bbf36b47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850182, "uuid": "d7430563-2550-4736-b9a0-c665987d19fc", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05192ba-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846737, "uuid": "c6c7e917-d56b-4202-bacc-fac2a9372a67", "comment": "Malware payload", "value": "df412281656b492a1161ad2a59c4d72c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846737, "uuid": "2bd3da07-b44b-4e7c-a31b-8d31b2356b18", "comment": "Malware payload", "value": "d8a4a5e3d008b1949cb7064f6948173dad2d7f7bfc8f40af3bc748fa29e311f3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846737, "uuid": "f0de2894-d26a-44d2-bb8a-87a7d8eab8a0", "comment": "Malware payload", "value": "107f678c4d56c6e38df5ce0bc7b2ed392da65bb5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846737, "uuid": "59e0c1d9-bceb-471b-a8e7-ee83a0828ae9", "comment": "Malware payload", "value": "8871eb26b6111810eac927e97c2d5168d889ee06fb4c84d06871b67d31cb2c2fda28d9b9a9195d4119fe30814a92f556", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846737, "uuid": "4397549c-2adb-4af7-a56e-b173cbfbed89", "value": "T1F811C017844741074A6D09E08D64D5A9B10EE1A9474FA9FB71549C5138103EF49AFCEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846737, "uuid": "2fdade98-2a63-4d23-b37b-f54a74835d35", "value": "24:/0zmMGuqwV530B7MnjAizoKnM5l3xzoKnm5eSWAa+T:szFcwV+gnjAi7iB7mn6+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846737, "uuid": "a8748710-2323-4eb8-b19b-5fa7641ba526", "value": 910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846737, "uuid": "9388b50d-a972-4f12-ba74-ade539cfbae3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846737, "uuid": "9eed4a14-a096-43aa-b59f-b3fc2f5fe816", "value": "d8a4a5e3d008b1949cb7064f6948173dad2d7f7bfc8f40af3bc748fa29e311f3.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e23c55e-fe40-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769821151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821151, "uuid": "4d3ededd-756d-426e-be1e-f2c6d79f5f53", "comment": "Malware payload (Mirai)", "value": "85847b1b3e1e09f8a251404dcabae8fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821151, "uuid": "a901710d-5506-4bf8-9471-6aae28e6e15b", "comment": "Malware payload (Mirai)", "value": "dc8726beb9415dd86e11e938e6f405a30ad059cf876b35e214809d4d08ce1747", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821151, "uuid": "11fe51ba-6e8f-40ac-af4e-bba8c48ba2b3", "comment": "Malware payload (Mirai)", "value": "4d51a4b3b8dc4d7fc6108a9b951bf2628b590fb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769821151, "uuid": "832d2595-f7ab-4e6e-9da3-7a1d39c6359d", "comment": "Malware payload (Mirai)", "value": "3ebefc83428c7c0c4b9bf34dd3f7f1b7f5f3c272355208d1bf59adbd57280c27a151e607e23d23162812441e90df73ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769821151, "uuid": "c078f69f-a9ce-4a3b-aaca-563e547f83f5", "value": "T1B7A30B46BD51CA12C6C311B7FB9F814C3726ABB8D2F93102DD24AFA127874EA0D7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769821151, "uuid": "5620214e-ac15-4201-9bd6-506fabb32684", "value": "3072:I5h89gxF1XWopCloHvcDq2uFa1h1KDTB/HjPuA/:q7xF1XWo8gv/Cf1Kh/HjmA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769821151, "uuid": "e94a517b-2c89-44b2-9863-4631a13da6b1", "value": 101264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769821151, "uuid": "c83b01a9-a7c0-48a1-9cf4-fe3bd353a781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769821151, "uuid": "441c3b31-abed-45d0-9040-9bcb88bd53aa", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87accd6-fe3c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769819826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819826, "uuid": "2efaaea9-6370-48d7-8531-469bbbd074a7", "comment": "Malware payload (Mirai)", "value": "0f1bcf6f9d592a5537ef3de7c6b98cf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819826, "uuid": "2ace19ab-3067-4d64-99ea-7bd4d9519c74", "comment": "Malware payload (Mirai)", "value": "dd4110e42548c324d5f215e43adb4fce7dc2ce3c662006feb6d347e107c097bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819826, "uuid": "f267dcd2-5d9d-44ed-87ef-a1e6d63d3a52", "comment": "Malware payload (Mirai)", "value": "e88c97b0cfda73d0c66c4b8085a11943520f4418", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769819826, "uuid": "d3bff2d1-9237-40da-b965-0aadb4afa403", "comment": "Malware payload (Mirai)", "value": "536ffc5ffa8a356b8f1f8866af8d46b366cbf44847a036fe224cb50c9686cd066e0a7eac26bc9b162057daf80192ef21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819826, "uuid": "5d5d0862-5fb8-4259-a45f-d274721010ab", "value": "T144130807B94680FDC0ADC374477AB53AD53335BE1239B3B63BD8FA12A986EA10E1D544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819826, "uuid": "695c7858-0bcd-4eb9-9179-682219d6c756", "value": "768:HO5xyjKy5klOY5lYDJN+Tb4/s3gHSAnWTtoTWufBT7AZA:C4jKy5klH5lYFsTbUs3N+atoTWuFkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769819826, "uuid": "506c231c-a31f-470e-be3f-a8fd2b2224b5", "value": 42752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769819826, "uuid": "8977cbf8-6545-44d7-b358-5aebdf25bb6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769819826, "uuid": "d87b26be-9bf6-4441-9749-65dd6d128de0", "value": "0upx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d946a936-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884628, "uuid": "c126d19d-9e46-4098-98c9-6aa9b3965b67", "comment": "Malware payload (Mirai)", "value": "206f08dfde1946734bfb0c25ffce0827", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884628, "uuid": "256c9cc2-f729-4d86-ad73-e2458a60d68a", "comment": "Malware payload (Mirai)", "value": "dff7e0396d30bcd83bfb689367b21fd0bcfeed214b45abae4d3e2cfa36b1e1ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884628, "uuid": "f076373e-ce62-4b6f-84e3-17d16c75b1ff", "comment": "Malware payload (Mirai)", "value": "d3669919c37e7915b60bdfbbf781fe9f8732a73c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884628, "uuid": "067e1544-a57a-46eb-ae7d-ff93aa1c0ded", "comment": "Malware payload (Mirai)", "value": "982fac112a813ddaeb4acf18a176aaabe35e17559eaf39b1d7c6bf499852c9715cac7e60731c7128f0924b67d5ee2bff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884628, "uuid": "226d5f33-373f-4915-80fd-a29a35390a9b", "value": "T17A839D23C9261EA8D05845F0B1A08F359763E218859B2EF76AAECB75C043EDDF5493F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884628, "uuid": "f7dfda02-647f-4a50-9cdd-442bc005d9a0", "value": "1536:lifexboEEXrtBU2KBAKetDuv0W5CK5kbifyd:lqex6rspBHe60W5XkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884628, "uuid": "1bbf1bb3-0368-42da-ae50-a019ac345eb9", "value": 80952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884628, "uuid": "846a9a6c-8521-4381-9599-0f299f3d6e6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884628, "uuid": "b0c835f1-845c-42d7-964a-1b7a159a3a12", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72531f8-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846748, "uuid": "5fdbae64-d7b1-4159-98e2-34891add661b", "comment": "Malware payload", "value": "244249c8ddf6cd2c18b431590d0b3700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846748, "uuid": "13ab67b9-6eec-41bb-a2a1-5b820dd162e3", "comment": "Malware payload", "value": "e103c1b11eacfc140ca59d60cc284b3ce8435151af0a5cab97bc863391fb7604", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846748, "uuid": "5baedd20-cab6-42c5-a4b7-ad888dabf54e", "comment": "Malware payload", "value": "bc7456e8932c155026f46ec9852a86f9ddad4c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846748, "uuid": "9b71e5e1-4dd3-40d7-b1ea-bf6cdde1f529", "comment": "Malware payload", "value": "2d442b5123d8804e40e7075cbcd0a67c6ac6f3328637f9a0d045f08362233958b68a6c9f5776d42f4e2242e5e56dcef0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846748, "uuid": "b7b9a657-d14a-4153-8243-ce9e2e8e641c", "value": "T153855B52F6A7C0BCC569C4B4D74BAA33BA32B889072179EF17D08A253D56FD0663C709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846748, "uuid": "c938fdac-f133-4abc-a26e-0db88946ffc4", "value": "087ab6374e409ea2cbda28563e19e6c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846748, "uuid": "5dc2704c-916e-4f66-9b40-c74d1c8177d7", "value": "49152:Ll3K/+Daprja027+MEhhusqJJnKGB4IU6i:x0h38oGBH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846748, "uuid": "7c1a182a-819e-4e07-b7a5-19c007a6837f", "value": 1841664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846748, "uuid": "b8113294-d3a7-4694-aa1c-465c9182ed45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846748, "uuid": "8bdf4b43-6412-41aa-b37b-619c874cebcc", "value": "e103c1b11eacfc140ca59d60cc284b3ce8435151af0a5cab97bc863391fb7604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6a8b7b-fef3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769898079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769898079, "uuid": "bafbd11f-e63a-4a8c-b449-1ba6bec6b97c", "comment": "Malware payload", "value": "07ba03e7e1673bb9f3709a3aa203f362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769898079, "uuid": "da2eb799-4c07-4723-8e81-eab49ab1dbf5", "comment": "Malware payload", "value": "e139d83928a106d94c0951cced11070dd1c0b9ecaa3a13aa7b90bfabe43e41c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769898079, "uuid": "789ab9a2-7d05-4555-8a34-2b96b2dbd1b1", "comment": "Malware payload", "value": "4542ad7df22ea4df71309208010712c0ffa5f7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769898079, "uuid": "088566fc-b582-42d0-a73a-358482ae8007", "comment": "Malware payload", "value": "9a8137b664a3bfe6278da7314b580f0aa3fc03a330591f5d2617690fd22655f6681ca14b62bf83a7dc0b0e15b9b51bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769898079, "uuid": "d4d3cf6e-0010-4256-90b1-acd6f1cdcc47", "value": "T16C8423BAE089C670C94DC37DE78795660755E141D70203BDE63262A83A4F3B8DE47FA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769898079, "uuid": "b8bdf15f-77bf-4454-8f05-732d77faf4a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769898079, "uuid": "e8dbbae9-ea06-4147-89fd-5103541e1069", "value": "6144:lPjMoLro/Y3i3eksyzZxlzoxhCRctQjCTPwCqlt2bgYS630Uns3K33fh:lPPgGiXZVXihCaYIMYSss3KnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769898079, "uuid": "eb9af932-5488-4e1f-9aaa-d1ccca561406", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769898079, "uuid": "ee654bee-9bd5-4944-a061-50fd1090fe3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769898079, "uuid": "9e748224-a528-4720-bd64-dfe597b68f64", "value": "SecuriteInfo.com.Trojan.PackedNET.3455.538.30334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201999e7-fec4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769877875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877875, "uuid": "baf58663-effc-4cb7-833e-f4c134630acc", "comment": "Malware payload", "value": "627af5c322a95a42906833fe4d490c05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877875, "uuid": "624318bf-60a0-4a31-98dc-fe80fd438309", "comment": "Malware payload", "value": "e462b4cd9a58c4cd538e4d87406fa8659661d260c1eb83f157ba2dd891a3972e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877875, "uuid": "efc6a17d-8783-4bab-a255-78a77636af48", "comment": "Malware payload", "value": "327bec91dfa4ed8e3bbd64554569306dc8ab2c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877875, "uuid": "9eb611dc-63b1-4521-a4c7-bf1b584fe5aa", "comment": "Malware payload", "value": "25081563b3bb2170a4b0b4de7a9df8b71ad68d64f4716b2d2167b7ab2fcee7f9e443c85be1f863a539159d71d2c96437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877875, "uuid": "3a1f19f3-1959-4ff3-9eaa-fa9e013e954a", "value": "T1379402DE758068FDD98AC038C7175F3CAB2672220F609CEB45A669243E77DC92D34E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877875, "uuid": "fa22f16d-2550-44f7-b2d5-80734a40c6de", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877875, "uuid": "a4aa9c41-a4c7-4703-8783-167e7d4dc834", "value": "12288:1CzoEU+AsYS8dePmGTCtbpngJh5OKJCsQ1Lw:18oP+AW8dePNGtFnasKJCDLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877875, "uuid": "0126f8d6-a58e-4561-b408-38008386b149", "value": 418117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877875, "uuid": "eb94c8c9-5096-455a-b7a3-02eeb757729d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877875, "uuid": "69c4db96-fdbc-42b9-8f43-f82bf8e33da6", "value": "627af5c322a95a42906833fe4d490c05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aba1e50-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846539, "uuid": "3cdda31f-9735-401b-b6a9-3ebb321bddb5", "comment": "Malware payload", "value": "e3795f41f35c621ee1f94a91e8d40653", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846539, "uuid": "a834d7cf-f9c2-4edd-8aa7-8a18dc603825", "comment": "Malware payload", "value": "e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846539, "uuid": "5e1b2c62-4ae9-4df1-8ce5-5d8acd4f983c", "comment": "Malware payload", "value": "b15b1f3f2227eba4b69c85bdb638df34b9d30b6a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846539, "uuid": "b8c0c69f-0746-4c66-90c8-42f98e2dc973", "comment": "Malware payload", "value": "03abc635db8cb546075539585246ba732968eb2be1bc03487e591fbc50973416980258659c76f5f3b1a270d344499918", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846539, "uuid": "36f5dba1-4f58-4248-b496-8d3b7d990063", "value": "T1A1A62245EFA9CE1EC47340370D9A5735665A9D2FC7828283D9EC3A18387B6E40ED4BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846539, "uuid": "1955b5c6-12f7-4772-a90a-33536ff7a3cf", "value": "196608:YjNg7h2oVDHtiyOp5cdkDnQ4uRR5h3CSAKG31nQ8m6Br:YKooJHtB60kuRRW/KG31A6Br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846539, "uuid": "a01f1e41-be21-4857-9e0d-7e32f79f88cd", "value": 9922273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846539, "uuid": "09e2ab8f-b648-4d02-9d98-45f6717da8de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846539, "uuid": "9669f85b-5931-4f19-801b-817c313d2208", "value": "e4aa98c1beee901871fd8a78b37b21ef886e507e65fc6499e3df3769081cd1cb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2352fdf-fe91-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1769856189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856189, "uuid": "4777cdf4-df5c-4e36-b1e0-e9a36e12a305", "comment": "Malware payload (MaskGramStealer)", "value": "553d1305eee8e5904f83d8d7cd1865de", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856189, "uuid": "b6777a95-fe56-4156-9275-7a91f8e7d2cb", "comment": "Malware payload (MaskGramStealer)", "value": "e512af88abd3b507426747ba75491f0c0f6798a4e6c717d44cee3de450d09b19", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856189, "uuid": "4e07a042-f153-4ace-b58f-b3c0ee6f73f1", "comment": "Malware payload (MaskGramStealer)", "value": "e6a8b688209ec561414803c815deaec11e73e0ec", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769856189, "uuid": "695a588a-6deb-4fb3-87e7-b74c251e9514", "comment": "Malware payload (MaskGramStealer)", "value": "f1e38152084a98a04061132ec9eda2cf2ddaa51aaaea15b01c69ee4f0a18f8876c42ec96876ce436adf431c89b2926d5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856189, "uuid": "07a2b04f-f3e2-44f0-8619-a345ad466018", "value": "T1D395338A5AE326DBDA130FBDC0D0E7D53B46604DB012E22BBE17520C3F46B6907D52D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856189, "uuid": "334c481a-9594-40d5-a802-61662e52daff", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856189, "uuid": "0d98fa9a-319e-4a62-8996-b4eed35fedcf", "value": "24576:Qjyu4YXxh0h/fhHNHVmWfa51glk6wU6xzo4SA8LNk3ybpFKRbUHbEYHnikhFfD3n:fcxS3zHxMQ3wdxUjVgCnSU4YlF7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769856189, "uuid": "abf121eb-8d47-4645-8b99-851408ea7e34", "value": 1954304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769856189, "uuid": "64592839-4bf3-4ed2-84d2-7b91894d7e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769856189, "uuid": "db3199da-a2cb-4699-9182-687230155640", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8be5674-fece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769882480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882480, "uuid": "cfa294fc-d2e7-4a64-9e62-a9d67e635683", "comment": "Malware payload (Mirai)", "value": "22a0e2906c99866360e6dd369ef186d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882480, "uuid": "0030de17-15a1-4b5c-8db7-5d75efd0985c", "comment": "Malware payload (Mirai)", "value": "e63595cd147362ea9c07240aa9fe7f1b9a8c81b242468daddb7aea7766648139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882480, "uuid": "562ff22d-9a0c-4c7a-91b3-b862bff8293b", "comment": "Malware payload (Mirai)", "value": "9afb7ca3bcd8cd3586dffb2edeae2bb896221740", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882480, "uuid": "d448877a-e5ce-4a88-957b-1c2bf7dcd4b6", "comment": "Malware payload (Mirai)", "value": "c5c052a1547c88717ae4a998c9b1a17c02e94125298f5b941122fbad1e2a466c471df8b4a08baac8e9d71ee9376724bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882480, "uuid": "2236a2ad-2aa5-4d05-bbe0-0f927e6c45e6", "value": "T1B9F31956FD819B11C5C156BAFE0E528E33131B78E2EE32129D246F34778A9BF0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882480, "uuid": "5570312e-3bf7-4cd8-b681-d70e5e9a8bff", "value": "3072:u+gZYIC4UcR1/pMpFhIQajlaXCnvCawY8UlZZTv1LjAEdYTH6lL:HgZYICsR1/pMi9YXCnKa38cbT1LjAtTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769882480, "uuid": "ddca8c3d-c040-42cf-8aaa-c13777c52d7b", "value": 166548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769882480, "uuid": "103fe395-b217-4fe0-99b4-cc4b3a4ea2e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882480, "uuid": "c8248136-eb56-4d62-9073-b8b07263d323", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4418b262-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769861185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861185, "uuid": "c113f395-d476-4dce-99df-cb5a98a0d9d2", "comment": "Malware payload (SalatStealer)", "value": "f8c68b6ae6daa9db37f1e5c16da98c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861185, "uuid": "85191717-2310-47b4-bfff-29f00f7976b6", "comment": "Malware payload (SalatStealer)", "value": "e8607f27adcc7f2d53de718c9989a34e51adabef9a03725c9b90dd5fadd72228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861185, "uuid": "f9af8556-a7ec-4673-b05d-cca5b4c3b502", "comment": "Malware payload (SalatStealer)", "value": "c2b38815336d73e238491a2f544db5b8c635f32a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861185, "uuid": "c0ee2ff9-a8f1-4b3d-b881-ea11248da790", "comment": "Malware payload (SalatStealer)", "value": "246ddc3956073bb1a745ea2f1a523704e141567e2d4b3423aa63366c83e9d22c09c097a2c4f0eacb324b7dbd557c02fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861185, "uuid": "49218023-7d44-4a4f-8d59-f377bf579b48", "value": "T11CE5339F0AA98C6DDFB8C87648F52C2B5C3C82368342259D4BFDF26659B779548332D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861185, "uuid": "aa631682-d0f1-423a-b857-cbeb7227d021", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861185, "uuid": "203cc0ed-59a1-4c56-aec8-97cbfd564dbd", "value": "98304:PDzgrzL03fUcX8jX/Xid8WwKO9kuG07xeijp75MYWW:PDSzLYfUVjX6d86ONG0L95rW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861185, "uuid": "7af096d9-3311-4cb4-9bb0-ece05f7a040a", "value": 3296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861185, "uuid": "d355a02b-7622-444f-aa7e-ac91be3b3826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861185, "uuid": "9fb9210b-5cde-4798-9791-d3a2da4c2798", "value": "f8c68b6ae6daa9db37f1e5c16da98c4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8a6dbb-fead-11f0-a129-42010a9c0007", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1769868264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769868264, "uuid": "54ca3f87-95e4-4674-852c-e49ecd548d1b", "comment": "Malware payload (Socks5Systemz)", "value": "32e759af27903aa2e45f078ac41d201b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769868264, "uuid": "c3d33c32-5321-4d65-93a2-1368ce70a063", "comment": "Malware payload (Socks5Systemz)", "value": "e8d499ad4ca9316f31db2dbd2253cc956a4f77f7e37b8713ea6268681d5ea060", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769868264, "uuid": "2fae821d-e2dc-4d24-9e68-dae7454563a1", "comment": "Malware payload (Socks5Systemz)", "value": "ee07090dd47d36597b74629712c939f4a085199f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769868264, "uuid": "f2b9f287-9995-4b51-9e42-a4288abd7b83", "comment": "Malware payload (Socks5Systemz)", "value": "ecc864aeee2b3fc36c962eb0180fb39d4d513ecfaaa891a883e025b06e1f63937c2b80e7a890d23d6ef6c6b1306c19a7", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BBX.file", "colour": "#3DAEE9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769868264, "uuid": "c22dabcd-4067-426b-b8b0-fcc76f7e6870", "value": "T1A2C51203B3850672C5B84735C4E347029336FC6A9B962BAF22C8F178DA832D5677679D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769868264, "uuid": "8241bf3a-2c60-4bfd-890f-eba08ccba833", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769868264, "uuid": "e9815bf5-9f85-45ac-8be4-3d8a332042f1", "value": "49152:8f1AM7mzcMf1AM7mzc1IdT2+31SFhU/3BuCQsp6qOU42ORf4jnPf8mJugZvXS9rY:y1A2mzcC1A2mzc1qTx31SFhYxNQQ5owL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769868264, "uuid": "cc36d19a-52e9-44cc-96ad-45f03dd547df", "value": 2651136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769868264, "uuid": "f0c2cb0d-74f8-4ca8-af9f-bdedc53900d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769868264, "uuid": "0853b2ca-15d0-435b-8962-56003fa76edf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd54a08-fe74-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769843483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769843483, "uuid": "763075c4-a931-43a9-a444-c4606cc67c2e", "comment": "Malware payload (Mirai)", "value": "5290eacb16554f47adf08816a1933638", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769843483, "uuid": "3885707c-f815-4247-8750-71c190e159a3", "comment": "Malware payload (Mirai)", "value": "e8e8f413844da5de3ec3fad51374c1e4be242aa0133e10019bcfbdc9ce47486e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769843483, "uuid": "241e2a2e-85fd-49cc-a51a-b290e378e7d1", "comment": "Malware payload (Mirai)", "value": "9a63a81eeb1b1081e328bec93efe2c8d860ff29f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769843483, "uuid": "bf38037f-b892-41c0-a164-90a234da8974", "comment": "Malware payload (Mirai)", "value": "996ff2faf81bf1a8b05993abd2c4fb60d98012c6207b135d83a0aca5bebe0dda4cb44369df2f6115b5c2e3309916214f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769843483, "uuid": "ead33a85-a0ef-4b7c-bd6f-b650445e2f9e", "value": "T1F7F46C02F71C4563D9631EF01E7F03E6C329595304F9D52A260EA7A61636E3E9AD33CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769843483, "uuid": "b0a85f31-e5f5-4e48-95b9-40ad1d26d046", "value": "12288:FclCNV750qPI0KUG7rAuvdSW0TBqTFrwHbLmOHGzipCzIXoo+2R7tx:3O6GAu2/3G3qoT2R7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769843483, "uuid": "51c02e3e-8536-4c92-85ba-39d8fd749fce", "value": 792192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769843483, "uuid": "6ef3ea88-9bef-4283-b3db-52814a37b29b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769843483, "uuid": "9f0cc0ce-5eb8-40f8-becb-4d3b3b578710", "value": "data.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf21b523-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884611, "uuid": "4a9af33a-2354-4217-a9e5-76eb2ab73513", "comment": "Malware payload (Mirai)", "value": "5fa4676a7642fc8bedc3b924eb56b888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884611, "uuid": "b3701814-c263-40a4-84d7-31fbad487a79", "comment": "Malware payload (Mirai)", "value": "e8f9d5b1194fcd26bfdef0be51547992d3893d9f4498d4dc8fef9390220fee95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884611, "uuid": "eadf6c69-e825-46f3-a7fe-cfb3ebb5bbe9", "comment": "Malware payload (Mirai)", "value": "d44b8b973010067a54b750f9e38befb44bae3d20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884611, "uuid": "e598df84-86a6-46e3-9046-cd791dc726cf", "comment": "Malware payload (Mirai)", "value": "57961ffcf0e1072d8e3d2b40928427a4acc38e416234feb1cff88a1f961565f1240025eb5ce00177de81856f8e6bdedc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884611, "uuid": "02fdf16b-13a0-4024-8d4e-9c2904dbe2d3", "value": "T125633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884611, "uuid": "ac43ccfa-e0da-4e13-b8da-d588f1ff8ab7", "value": "1536:lGRaTYmol/hGIAs4PNvAEQBGm75123tStmV:lya7hJqGmVDQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884611, "uuid": "7404bb03-5d9c-416a-a1eb-c7ced90c5190", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884611, "uuid": "47ae7a43-f0fc-47e5-89ca-12db302e13bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884611, "uuid": "f30f8d04-2d9f-431f-b96d-cd70d70ffcc6", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82f15c6-fec8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769879821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769879821, "uuid": "65514f8f-11c1-4c0b-8361-c9652d67325f", "comment": "Malware payload", "value": "439c9ab97ed1e5f80ea7815d2f3b7e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769879821, "uuid": "ff9b5443-553d-46ad-b9da-95e9c8e3c98d", "comment": "Malware payload", "value": "e932a31139ea85bb0870001220da9b838f217e285be6d1b5e0f12810bdf3ab71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769879821, "uuid": "a31f79fa-5c61-4a7d-9fe3-869b9c3b63fa", "comment": "Malware payload", "value": "f24a5244152297d8c1e706a6d88f04fdf87b554e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769879821, "uuid": "96b3eeb3-8bc2-4c0c-a604-47b40c6010bc", "comment": "Malware payload", "value": "0551938643914aa0bfbe05923ad5ad760641757036a54b4012e788028da9d97c1975ac2d88472ea5bf205f031c79cbb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769879821, "uuid": "6a3dd049-5411-47b8-813d-11b070747a2c", "value": "T1676439D47C8583B6D8651B3014E59B77392EA8BC4F5C5EE723940A69CE302C0763EB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769879821, "uuid": "7f2d9e59-e1de-47dd-a5b7-a7fa8b959d47", "value": "ff510448050ae8e644fd53aefa325d4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769879821, "uuid": "b1881630-99be-46f6-8ca9-96f24e5bf6ee", "value": "6144:yiJ6Xdgcw6Yy+qsrAO9NZ+GC2eCTX6z1jxK:yiwdgcVibNYHQTKbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769879821, "uuid": "cf9cc240-7a5e-4749-94f9-8f83fb452784", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769879821, "uuid": "b1dcf1e3-26f4-47d4-9cdc-6d23c842e7f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769879821, "uuid": "5f17b881-7649-40ee-a5cd-4ce9413534a8", "value": "SengokuDynasty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccb7396-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884634, "uuid": "8b4ee56e-4394-4f30-bff7-c1c7be8daa63", "comment": "Malware payload (Mirai)", "value": "83d9ec02c0d63260b7ed75ad4132cd86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884634, "uuid": "a52717fa-c494-4c6b-8525-086148791d67", "comment": "Malware payload (Mirai)", "value": "ec3ebfb7ebf3f48e2b4fa2f85f54016f350bcf3fd31ba4b2529bd12f9b065ac4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884634, "uuid": "a8cc9938-d293-4f70-9727-21b622af1857", "comment": "Malware payload (Mirai)", "value": "58af22837046ef5ab642f0c1e18d2f08218f46df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884634, "uuid": "a4049ed5-4eaa-4571-bd55-e405faad88db", "comment": "Malware payload (Mirai)", "value": "58722bcbb44ce72dffb3db9b97c879e01e7f8fa825767aab811ab0ab851d226d7fc36bb479d823882d63b956ae1451f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884634, "uuid": "086e3922-4c5b-42a8-ad47-7831ac6f8167", "value": "T1AD73F756B8814B11C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884634, "uuid": "3c004410-8ef7-4e1d-97d6-f2c15db5cc1a", "value": "1536:2lntExPgXkpdDHkM7kdxO4uKbWkcaoN0sIci7XzWv+AcY5sYIWL:bxIXCdEdl5lcaZXzWv+AcYuR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884634, "uuid": "73f63164-40ac-43f0-8413-08cc39ca21ee", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884634, "uuid": "b94aa9a9-409d-402c-a814-28a225c75f71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884634, "uuid": "2fbe908f-9e82-42ff-99a5-3eb7b8e93c68", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793d1b64-fece-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769882319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882319, "uuid": "7f3d7cf6-1b20-40d1-9ddc-d9c7ddae2d82", "comment": "Malware payload", "value": "65b02f0eecf117db959e666a8a453425", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882319, "uuid": "0db7e27f-5917-4af1-99e0-8dd1e59deee4", "comment": "Malware payload", "value": "ec5906e296a2003ea0582d3176f23a0cd26f72a451bbafbd889de910f5bff12e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882319, "uuid": "68629ec3-f711-4122-a4c4-0f9ef813ef7f", "comment": "Malware payload", "value": "2308d771d24bc4c8d4dde2a27fa67663e32a88f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882319, "uuid": "4337e418-cdfb-4bf5-a359-9173a312c7d4", "comment": "Malware payload", "value": "ed50ed7f88c3075f035dcd0503c6f165a40f56447e35a34e7febbd04a3ee7f2011d371172d7188f1ed5954276d642b26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882319, "uuid": "241faefb-dc7c-488a-8692-2d63ccdd7684", "value": "T1E5E31945FC518B16CAD662BBFB4E428D772B1768D2EE31039D256F20378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882319, "uuid": "8c950704-0697-407e-a382-3381d8238f5d", "value": "3072:O/jopHZAp1qu9ycDLntl0LltYQPBJPi/4fjBImxmjyoHVcNLh:OropHZAp1L9ycDLtlu5pK47BIYmF1cNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769882319, "uuid": "47ddc96a-39a1-4fbc-a230-f3dd3efa93de", "value": 154168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769882319, "uuid": "739ecd4d-2654-4d76-9658-a514bfe1a22e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882319, "uuid": "1caca789-59e5-4ef3-a79b-20975bcc0ed8", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f68ed0a-fe85-11f0-a129-42010a9c0007", "comment": "Malware payload (XillenStealer)", "timestamp": 1769850789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850789, "uuid": "628a3cf5-38ed-459a-9aa2-8161651ab98f", "comment": "Malware payload (XillenStealer)", "value": "661ca62ab5ad203bf3db1b412de7898c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850789, "uuid": "1928dadf-8b73-428f-850f-eb396954b9b8", "comment": "Malware payload (XillenStealer)", "value": "ec5df8e292717758febd62be53bbc1ce7d54709f2efa604741a4d9ba39eea412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850789, "uuid": "9a7fd5c6-5f7c-4570-b4b0-af95ce9a9433", "comment": "Malware payload (XillenStealer)", "value": "aa507f73eff415acb2bb7e04fd84e69396657b7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850789, "uuid": "071b88e6-827e-4f0c-b9b6-b60c0e27b540", "comment": "Malware payload (XillenStealer)", "value": "25ba078b85a928acf665a1c8c0b01fb692b5dadfde7e9c937da92f6140dce60187a71aaac97a52816841fdc26692ed09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XillenStealer", "colour": "#96DFFD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850789, "uuid": "e85b1bc4-dda7-4bbd-8b88-3bb34bd36cc2", "value": "T19AF59E17E66244EEC1A7C175861F9233BA30F85A16317A7F2B58CF292F16F604A6DF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850789, "uuid": "37fcdddf-e87c-4639-ba2a-1ba33b8465f8", "value": "ceca38aaf88246327be57ca0f6e1d1b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850789, "uuid": "233ab3ce-6d14-4a30-80fd-15c0b578bb4b", "value": "49152:n6PQVHIzVMupGzKevKLLKKaaKKW7cVaYnM52AkgIv1vD+fOTRomvEdQ:n9IcIaIXn39Tuk2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850789, "uuid": "62a553d3-113d-4047-809e-6e6a1bffae64", "value": 3516856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850789, "uuid": "453d1979-6135-4580-a2af-bf35eb9cf669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850789, "uuid": "69361b27-7818-42ec-8248-6a2a9c5bdeeb", "value": "ec5df8e292717758febd62be53bbc1ce7d54709f2efa604741a4d9ba39eea412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db637403-fece-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769882484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882484, "uuid": "bad04a9c-5dc9-433d-b407-df13259b9591", "comment": "Malware payload (Mirai)", "value": "3c4a270543ef2a0746b279fa239529d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882484, "uuid": "9a0d7d95-4704-41d2-a6a7-7a9720699a82", "comment": "Malware payload (Mirai)", "value": "ec7a7da160f763fe001cd6ee1460749d405864ff0e56d49919385a2046997934", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882484, "uuid": "a5065d51-0859-457f-93f9-c3640d8becc8", "comment": "Malware payload (Mirai)", "value": "79ce2bef440219a59c063835c98f8b9d0ebbf137", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769882484, "uuid": "9b794092-b279-485f-899b-89cb2d7f8240", "comment": "Malware payload (Mirai)", "value": "b6794ba1fc344bf591fb9e5744b8416e3b354d3026ce39adb32c6c50650aa3a7f777d1c1d66098bddade1a10bddcfe14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882484, "uuid": "6a96e0ee-22da-4f58-b8cc-b3ff8ee1a5c8", "value": "T182E33A06B30D0947E2632EF43B3B27D193DF9A8125F4E644355FAE4A91B2D32158ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882484, "uuid": "a6fa1e3c-a4f0-45c8-a2b7-a2d208a8e605", "value": "1536:iHb7CO4BefO4JkcqfvLxuNnMrZ9uxX67FxfhE/iGfqzm7cuN+LDTxEzO8aCWDBrp:i77CO724cxNjR5Ru/BoEzOqW1lae2Ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769882484, "uuid": "91b173a1-1237-4d56-a06f-cf8abdc0453b", "value": 154348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769882484, "uuid": "0564b349-fe39-43ce-add9-2228dc7a63c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769882484, "uuid": "534427ba-2137-404e-8d2e-7568fc2eb0d3", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4478c0d0-fea0-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1769862474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769862474, "uuid": "9ad8e255-5cb1-4ee8-b813-ffa9f87ab915", "comment": "Malware payload (SalatStealer)", "value": "2ba2409b7771a25f8723b16f8644e7ce", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769862474, "uuid": "7050c2be-da0d-4c1a-9aa7-7fb4c6f67015", "comment": "Malware payload (SalatStealer)", "value": "edb2e646f7d889b6d979f2d5d53c075d2f454860777a91c6619125f95ee7e88f", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769862474, "uuid": "afbe1912-17e2-460f-b5c1-2dbd67b37ba1", "comment": "Malware payload (SalatStealer)", "value": "4567834aea8921cacd16e488d3aeae66494bb085", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769862474, "uuid": "3b183c56-4181-469f-b815-7050093b8b20", "comment": "Malware payload (SalatStealer)", "value": "7f0f028e5a05b1b7f480d9fd123181e7075cace168902b9212bb2551f8b8bbc813427d82b427a45f6e1adb9cb9ddbc13", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769862474, "uuid": "eb6fa51d-eb82-4c90-95f8-e790616d75e9", "value": "T133D5E112B2CBEF3EE05F0B3705B2A15454FB6E516D22AFD696E48C9CEE250501E3E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769862474, "uuid": "d1516b25-b1b2-41ab-a726-1a5065e73dec", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769862474, "uuid": "8ba38f4d-3e6a-4645-bf0e-aa63dcdc68eb", "value": "49152:k+MRdOHMF5as8s56XP0qveojUNQ82uvzCFD5ZvCx/KjPEAiJ/6T:krB7asbEP0q2sUB7zK5ZvCpKPpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769862474, "uuid": "dc43fa3a-cfa0-47db-87d0-9236d8d7e418", "value": 2998707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769862474, "uuid": "a55b2e7e-1fda-45ab-9af7-859077001e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769862474, "uuid": "c9fba8e6-f98d-4789-848c-011686013a92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7164b68-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884624, "uuid": "d13f548d-850d-474e-b99d-41020364458b", "comment": "Malware payload (Mirai)", "value": "d553b7c387bd1343a8d77ba10943182d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884624, "uuid": "83b37f19-3be7-4317-96c9-28c11206dcd0", "comment": "Malware payload (Mirai)", "value": "ef2749d13d06b92a3635dbabe80c1d1f7b3166f42ca9d88f7f511f96dafb0c57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884624, "uuid": "ac554d69-d744-4918-ad75-d3cf52de8728", "comment": "Malware payload (Mirai)", "value": "1af98e01e7fbae1c531fc1863cb35b0c8413727b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884624, "uuid": "9889a586-e371-45a3-a0f9-5003bc805403", "comment": "Malware payload (Mirai)", "value": "2a3288783ac0182b17fd63113f90c3adfad8541e0604b4fcd5376cc4088b246d89ab2be46ccbd28e60591e209c0d7305", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884624, "uuid": "4852a6ba-7e30-4aac-adb8-6aa573615ed4", "value": "T11A03E651BC829A67C2E1137ABAAE5A8D333163D8D2CF7217D9214B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884624, "uuid": "dcdbb0f4-9baa-4ae6-bee3-f8fcb3c49bee", "value": "768:wgJMCbqsG5f0OtnlUlYOJFFARwAtb9LnWwaCv+bv1C6ibXoTi/NZwW5:wub1G5fPlUlDf43aw9v+sb1MW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884624, "uuid": "9b20c024-96b1-4cb9-93d3-effa594deb21", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884624, "uuid": "71694977-e3c6-4f11-a6ca-93c96f2869ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884624, "uuid": "d7a07115-9079-4922-9145-59da06fe8329", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e0ea93-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884617, "uuid": "405a14d9-8678-4110-abaa-8d22804b16a7", "comment": "Malware payload (Mirai)", "value": "5dd6d40df02fd238524e1933b8fd6fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884617, "uuid": "5833ed8f-f4ba-4e07-8317-9b228c6aaf08", "comment": "Malware payload (Mirai)", "value": "ef28bff9c3ac06bbf4645c915f8391e4b492bf24e91281989dd94ffac1e0facf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884617, "uuid": "d25fbd27-cac4-4c2f-93ba-a2f26ce6b26a", "comment": "Malware payload (Mirai)", "value": "364a627eeb8bfe7a6d34da5064c026c1118f59f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884617, "uuid": "79908727-3ef4-42b2-a6cf-850f66684b39", "comment": "Malware payload (Mirai)", "value": "2007fd497d9d313fb45924da5784cf6641d312a566efc06d85b74981b724264603bf15016696af8ddf417c55f2374764", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884617, "uuid": "35f92174-0246-43aa-9237-ad880d72a40e", "value": "T116833981BA4BC4F5D8474870806BF33FCB72E1394065D65EEF9BAF26DD23642621628D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884617, "uuid": "69b82509-7771-43b7-860d-f570e117c1a0", "value": "1536:ut/CxRjB9owk0aJihi6p2EuWzqfnrdbYnR2JqbJhVuAQ:E/GRN91XaVrsufnrdUnoQV9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884617, "uuid": "0ac39d89-6dce-4f32-b361-8638ec950021", "value": 84400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884617, "uuid": "8082af6d-6df9-4447-850a-b3be55eebfc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884617, "uuid": "188ea7d9-f80e-42a9-9beb-99a4b77a9231", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65d9bf4-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884623, "uuid": "649d11c8-91be-43e6-973e-f52c585527f5", "comment": "Malware payload (Mirai)", "value": "9b4ca34e77b48bb996fc62e762dd0a65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884623, "uuid": "e2e31fbe-612f-49cd-9853-670d60bb1d64", "comment": "Malware payload (Mirai)", "value": "ef4eb65b44e082dc9016a81f7c5cd9106b9cb8beba84ddc5193f724af0fe5ab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884623, "uuid": "db27e3d4-7b0a-41da-a824-ada67a0cc93d", "comment": "Malware payload (Mirai)", "value": "9151362b1a2aaf6e8901ff48c88dec484424f259", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884623, "uuid": "7919a018-b2c9-4502-bcf4-a0a3bb55212c", "comment": "Malware payload (Mirai)", "value": "d022b2dc8348bdcba8ecd3aef15053bfdf39e8d64c9b44c55cc1810b50b6a1a820fcddbcbd227738b1d1695104036da9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884623, "uuid": "f649e028-7532-436a-8b06-22d14b9b65ab", "value": "T10D736CC2AF47D4F1EC120472217BEB725673E53E1029EE87C729A932ED52601D26B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884623, "uuid": "3be06422-109f-4a9e-8086-3801e5d85590", "value": "1536:8UMYASDKepcEwK7wPWdkETb3NvR9dRqHcsZ4O4hF:8F/etwK7HFTb3VR9TenZIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884623, "uuid": "d3c51f83-5019-4641-8ffc-51af94ab0236", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884623, "uuid": "05b13913-edda-48ce-8b42-ec5093a649f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884623, "uuid": "3ca3fb92-83d9-460a-b318-49c042f0b5b8", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5725af01-fec4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769877967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877967, "uuid": "d6c05bd5-a24b-4046-989c-8869e5c7bbbc", "comment": "Malware payload", "value": "b504d05dad0e6b610fcf43a17241c4a9", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877967, "uuid": "dbfc110c-b594-4363-90fa-38ba4538e92d", "comment": "Malware payload", "value": "ef77fba85a86f5a4c8577e97739eee37dae80f8e4e1f1a797ed24291765b503d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877967, "uuid": "38ec9a52-e11f-4ccb-a882-750d503d481f", "comment": "Malware payload", "value": "f84ce7538f1960375899098d7b706dfc9139b17e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769877967, "uuid": "7661a2f8-7704-4a69-a1c9-ec390ba53235", "comment": "Malware payload", "value": "c0ed0ceb871e6c5718682d14bc227507cdb5ec6012d0b6bc91bc1845c46ffcc63388c49e5c9af3e6ccb8f868e170c872", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877967, "uuid": "bda997c3-3992-48fc-966c-dc0bc5626e3d", "value": "T1285168101EFA0258F37297356BFAB3228977F851DA399AAD004D46441B73610E464F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877967, "uuid": "c9aca151-db99-4cca-9b61-de808bb23987", "value": "24:8lw/BHYVKVW/s+/CWNY1IjHaogeHCW4ev6dd79dsHT3:825a/IIj1geHCEv6dJ9y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769877967, "uuid": "01d505f7-97d2-4aa5-b8b3-7a1cdb9f8a11", "value": 2882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769877967, "uuid": "f68e6d59-855b-4137-9e6d-2947e0155d1d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769877967, "uuid": "3aa1e860-cd96-49ea-a38f-ebe7f25c4c90", "value": "GoogleReportExportMain.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e77a19-fe82-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1769849667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849667, "uuid": "21ef6a92-b774-411b-952a-9ddc68714636", "comment": "Malware payload (CoinMiner)", "value": "9ec6bc11dee711237f01c0124f9ca00c", "object_relation": "md5", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849667, "uuid": "b9399858-2f59-40a5-8553-4fa2c9cf8407", "comment": "Malware payload (CoinMiner)", "value": "f0eff94e8ed95c8ccb19decb14f7edcf036830502745ec47fd64152e8b6e42b9", "object_relation": "sha256", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849667, "uuid": "36d69976-7c53-4bc5-8c61-bc84aac36f55", "comment": "Malware payload (CoinMiner)", "value": "a65671f28d52ea1730e671316a29b233f0fb0397", "object_relation": "sha1", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769849667, "uuid": "f6b0c72f-591a-43e5-b6bc-d551947c742a", "comment": "Malware payload (CoinMiner)", "value": "6cdb204f12b7e09dfb5ad024c3ac06f114b7bb20b433f52c2a96b7ae731c88c6718d36efe832263692d1707d515ddc2b", "object_relation": "sha3-384", "Tag": [ { "name": "BitCoinMiner", "colour": "#69DC5C", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849667, "uuid": "db071b86-31f1-4aa2-bd2d-3c4f240002bf", "value": "T1CD97E0000AB929B6D073877049FECD7199767C9A751CC09F1096FE9F3D72B029E2963A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849667, "uuid": "81f76314-4490-4d6d-8e9b-aa2e0bf2b117", "value": "7716121b91c589bad02078b163c20df1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849667, "uuid": "5891bd57-2154-4078-ac51-b013f5f8d159", "value": "786432:4l4ZJpuJOUgpC4ImWjEiO99uuhOzA6z9iP:pDpuJNUfNWWlOzpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769849667, "uuid": "d8727943-f317-4f23-ae9b-c97c4c286e22", "value": 40272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769849667, "uuid": "d2c1af26-0fec-4dc5-8c43-99ceb61da899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769849667, "uuid": "c3cb90b6-a867-419b-84f9-471305b7af5d", "value": "caaservices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a494084a-fe9a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769860058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860058, "uuid": "21702005-2ade-4074-98de-f37215704917", "comment": "Malware payload (Mirai)", "value": "3549bca0ce24e1b255c8d50cbff89f51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860058, "uuid": "e4be8d22-c761-4fbf-b9a9-4921fb3afa27", "comment": "Malware payload (Mirai)", "value": "f1c2f1ffa26c4e443d12cac3498193701b59ee2394387d52b07b9c41be537fdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860058, "uuid": "1e11663f-9a81-437d-b3c5-e8530c9a51ce", "comment": "Malware payload (Mirai)", "value": "4c3042122a074e723641232d3da8b6257b6c2c18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769860058, "uuid": "72d1dcfa-5fef-4b26-852d-165fa4f56280", "comment": "Malware payload (Mirai)", "value": "e303433aba914e42f45a254b1912da3da7d4cb9615e1d356497981e8941edaea0455d9d1f881fa90e5b4f68086db6eb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769860058, "uuid": "cddff6b3-0053-4bcf-b175-85447f338309", "value": "T1FA335C02775C0E43C42A2AF4353F23E5D7EFEAA120E4F585694E9A46C175E33059AEEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769860058, "uuid": "cacc2a1e-3994-44c0-9a67-14d5d222288e", "value": "768:+x4rT0M6NIYnCTsTDr6aIwUSAk42hftkSGsv6H1ILt6S:T0NNQTsHrjbjfTS1Ip6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769860058, "uuid": "4d28775f-5d3d-4119-929b-a75d019605f5", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769860058, "uuid": "9e78a449-09b5-4a99-a760-b025aa9f6759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769860058, "uuid": "7dc4f9cd-d5dc-4d09-8f48-99d5d5545d7c", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c97a6eb-fee2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769890942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769890942, "uuid": "08b0fdd0-eab9-4ad0-aa59-41100b1a4ff4", "comment": "Malware payload (Mirai)", "value": "958fce34dc27f9d4f775fb2e955b099a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769890942, "uuid": "26659e35-9038-4a39-85e4-897125a5e0c1", "comment": "Malware payload (Mirai)", "value": "f687c5d194be8f777cc5f862f56107aca078744455f8eb32839be369544ec313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769890942, "uuid": "57125e6c-153b-4ff8-b220-0e81398230d1", "comment": "Malware payload (Mirai)", "value": "31a765fb6f75e0365685712df63d70c22325d585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769890942, "uuid": "3985bc54-e5dc-4834-979f-b3687821cb5a", "comment": "Malware payload (Mirai)", "value": "51226408d7a8b8554fe8c27bc32571fcb534aa734f8720db60c96bb5abe8070a3a4f2340995fb66c5e44688e04e8a7ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769890942, "uuid": "a8294063-7ec5-44f3-a067-f00d675e7589", "value": "T100056C4BB2B374FCD057C53443ABDAB2A935B42502226E7B65C8D6303E1AE701B1DB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769890942, "uuid": "720cd3f0-9ed4-4bb8-aa24-a114bdba5c50", "value": "12288:D9Towsf5fFi4spVD/Gk0qy6/EoUlvY9v1vqtJ+fpp98AgeidzuFR1JykdLhS7WHX:DiwoS4suk0fAMw9dvqtowAeSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769890942, "uuid": "a1e946e3-cf64-4c83-978f-13a8a98fe116", "value": 841384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769890942, "uuid": "8814dc6f-fbae-4f7a-a32a-4fa3a94ce442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769890942, "uuid": "c0f2d79a-9ae7-401f-9eee-a00c48ab74a7", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa685f6-fe7b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1769846762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846762, "uuid": "974989da-2c00-494d-ae88-f1c99202b6fb", "comment": "Malware payload", "value": "90cb9521e49d99d35fdc7ab89ca22053", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846762, "uuid": "aa6674fa-9b52-4507-9ab4-5879bdb39972", "comment": "Malware payload", "value": "f7e71c59587123ba4d88b8c4f5da821beaacc61e67e7ae0d1832bb4fdcafcd01", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846762, "uuid": "1491cefd-e27f-40de-b66c-7b4699d1e724", "comment": "Malware payload", "value": "66cbb216791b7d58bfa310377aeca24f5e75f7e2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769846762, "uuid": "ef5d9575-fbb2-4c0d-8fb0-c056deb12cb9", "comment": "Malware payload", "value": "2204d91520d8a474a6d912db7067c9dde4020f41905a8ffe98f568f221cddb75c6055b53fe5f6a2c02937213c58d2bfc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "hitpak-org", "colour": "#7C8E2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846762, "uuid": "b3da8152-33aa-4cb0-b6e8-187b5d7827d0", "value": "T1E9D0A71711C362078D8C48555C6AF54CA01E686C6D412BF32B695C0765524BBD5C6D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846762, "uuid": "9c8f39fb-979e-49e1-ab96-feae33a15b26", "value": "6:hSG8qOLh8JJxzE5KiE+95IAu4VN23fi+vN2voe6kz4VN23fioxw:0G8JG3xzoKnm59PONW0pO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769846762, "uuid": "f2ee2552-69a8-43ec-8127-b8d876172abf", "value": 240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769846762, "uuid": "a84a6695-f9b3-4ad3-b3a4-1bdd462273fb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769846762, "uuid": "5fddf510-578a-4dbf-b61c-eeb1eaa7fd02", "value": "f7e71c59587123ba4d88b8c4f5da821beaacc61e67e7ae0d1832bb4fdcafcd01.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51eb989-fe84-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769850745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850745, "uuid": "1660d1a8-af30-47a2-b184-34e2d2eb7344", "comment": "Malware payload (Mirai)", "value": "f32580f0537ace193c61770eb3a823ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850745, "uuid": "2066b1a0-742e-483a-9c08-15bbc0ece0ae", "comment": "Malware payload (Mirai)", "value": "f91d717a73571e6243cede15f7236e30145aff5f5f31cd78d37fcc5e73d7576f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850745, "uuid": "2a8d0c37-a219-4da1-a84b-e29f4c52572b", "comment": "Malware payload (Mirai)", "value": "9617c300968277d579dddd7694c5c1ffd9f90b0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769850745, "uuid": "b1628a5f-4588-441e-89c9-4a23a41c34b9", "comment": "Malware payload (Mirai)", "value": "e5335587e5e2b756cda411fcff3f14ac77d5562a6e9ac05e5bafb16305bd8cac16216dc4c5693735786fcecba4204dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850745, "uuid": "ed16652c-4a87-4268-a342-46ddbf80f2a5", "value": "T179F33B13B7324F91D726D1720BB38B595AEB11821EE248D5936CCB143A207E9689FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850745, "uuid": "2640b83b-f698-4cf5-90de-126dc50ffc8e", "value": "3072:M6pd2Six/LLBP8VsxumMkJXYF84OWZCrfPq8pa:MYd2SeLO+VXWZZKCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769850745, "uuid": "b0b74924-1c5e-4f98-9644-db7892cb0a86", "value": 167964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769850745, "uuid": "209e6e4c-ea2b-497a-86af-a8948a536299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769850745, "uuid": "3d9b21f2-7438-404c-8db2-92cf5a8ba6e0", "value": "data.mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c7f507-fed3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769884626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884626, "uuid": "1275765c-f7d0-4941-a381-82523d475813", "comment": "Malware payload (Mirai)", "value": "8386eec1fe6f90651ef5e0255c7dbf9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884626, "uuid": "9039f333-cfdf-40a4-a760-2857aab5cb1a", "comment": "Malware payload (Mirai)", "value": "fcac1a40f82f83d7a46c77055b948952bbcbc385eecbd72fb8f55f3c90ed7dc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884626, "uuid": "af3ad77f-9963-4779-a6f7-18572b3bb8e1", "comment": "Malware payload (Mirai)", "value": "732159f16716fbb857fd9f0137be60dc0c717e9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769884626, "uuid": "d3c47107-9947-41cf-a30d-f8e5fde6b483", "comment": "Malware payload (Mirai)", "value": "0464edf5d6d60980fc0bb420bfff0dbe05084b04858e7e199e2e467a83ca4fe8e712ad406551f07d837596f908a41bbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884626, "uuid": "4c3895d9-adc1-43ff-81aa-d7a8352cca60", "value": "T143632851F8819A13C6D1127BFA6E02CD3B2613E8E3DF72179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884626, "uuid": "ecdf2214-1667-4bb2-9ec9-73fcbfb5c066", "value": "1536:rNHlxvmiiBmLv/RN/596yw4BxF+2YWfwz2vvWm:rNprxIr4BxF+5sbv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769884626, "uuid": "74d85c6b-fb6a-458c-ab6e-6281c9c03a41", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769884626, "uuid": "8273db72-0a98-4a6e-b68a-223241d7186c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769884626, "uuid": "ff8cc447-3699-4d0c-a30e-6a2d822b463b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef3df49-fe90-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1769855593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855593, "uuid": "a9a41945-e7ff-4c8a-ac3f-354273646620", "comment": "Malware payload (Mirai)", "value": "0ad514b30f100b814a03ae914a50c572", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855593, "uuid": "c8694a16-ded5-41c4-aff7-668b92e10170", "comment": "Malware payload (Mirai)", "value": "fd1860f44aad6b41f79fb81b096d1c7ca156a657720085283b7a3b88a4f89226", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855593, "uuid": "a1d562d6-3363-4eb7-b401-258f1025f160", "comment": "Malware payload (Mirai)", "value": "1623a0231b073be8d4121abd1fcd5618b79fc08f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769855593, "uuid": "23105611-6a64-40f1-823b-83bfd5949f41", "comment": "Malware payload (Mirai)", "value": "5e62b2f331feebdc1c8a71e6fc4087c904c0d2e0335fe94f4b6f935f71237c3b7d60b3a5973a680b4603910beca99804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855593, "uuid": "deb49ce7-6419-4f5f-87e3-ebb7bc93434c", "value": "T15C343B45EA418A13C4D117BAF5AF418A3332A7A5D3DB7306D9246FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855593, "uuid": "c19c95fb-d032-4b88-834d-0ab7b05e088c", "value": "6144:Ego/jNgGzHzakeqacEp1d4n1trwbf9ihM/9+AU:EDhgSHzakeqacE3W1i0G/4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769855593, "uuid": "6026ad86-e09b-4b3c-ae1f-295209dbab82", "value": 230976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769855593, "uuid": "7a4e5e61-f7c3-4974-a8ba-c3fa44202e01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769855593, "uuid": "ed9c72bf-3cae-47f4-8e00-da18665b35cf", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bf79d3-fe9d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1769861315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861315, "uuid": "60c52f34-085b-4451-8231-89eda154a21a", "comment": "Malware payload (Vidar)", "value": "97a31c5bf745c361fde0636b112d3989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861315, "uuid": "e0d5162c-2d73-4146-90d5-5329d3dd359e", "comment": "Malware payload (Vidar)", "value": "ffa35e8c18950c68e2888a96c7138493c213c52747a45c5914f468a5ea0acdcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861315, "uuid": "e511c602-f149-49eb-b8b9-34adae93a389", "comment": "Malware payload (Vidar)", "value": "e48589cacf866a2e216878dd8b1f8f0ebdf3df59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1769861315, "uuid": "bcc172e9-5e0f-4dc8-82a9-985c7504364d", "comment": "Malware payload (Vidar)", "value": "49d2d48450c06afdb81e366d0f0b9fb84030a943662d538e161ff789f49057c49115ff152a6f2458d9cb5452b924a920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861315, "uuid": "e22277cd-0976-4f8d-a356-e690f5009c1e", "value": "T181A4187E9C60E376F50DD0BAE285D3625E2178410125EFB328E9E7200589572EB1B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861315, "uuid": "ace2ccb0-02c3-434b-b75c-afc500da21e3", "value": "1e377d8de82679ecce8fc97b181c89e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861315, "uuid": "0fcbd6de-143c-4a5c-8c70-6802ced23de3", "value": "12288:yEDpyhao0xX+I5sOrJ3jHEm4Vb+2yjJ9:yENyhV05TF1Am4VbcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1769861315, "uuid": "bddbbe93-2024-426c-8c8a-0cca424a29e0", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1769861315, "uuid": "0231b7a0-73b9-4e3f-951b-1e31df0cd818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1769861315, "uuid": "50b4975b-943a-4e97-bdab-80122578d302", "value": "Wfo8KJM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }